openapi: 3.0.3
info:
  contact:
    email: hi@ory.sh
  description: |
    Documentation for all public and administrative Ory Kratos APIs. Public and administrative APIs
    are exposed on different ports. Public APIs can face the public internet without any protection
    while administrative APIs should never be exposed without prior authorization. To protect
    the administative API port you should use something like Nginx, Ory Oathkeeper, or any other
    technology capable of authorizing incoming requests.
  license:
    name: Apache 2.0
  title: Ory Kratos API
  version: v0.9.0-alpha.2
servers:
- url: /
paths:
  /.well-known/ory/webauthn.js:
    get:
      description: |-
        This endpoint provides JavaScript which is needed in order to perform WebAuthn login and registration.

        If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you will need to load this file:

        ```html
        <script src="https://public-kratos.example.org/.well-known/ory/webauthn.js" type="script" async />
        ```

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: getWebAuthnJavaScript
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webAuthnJavaScript'
          description: webAuthnJavaScript
      summary: Get WebAuthn JavaScript
      tags:
      - v0alpha2
  /admin/identities:
    get:
      description: |-
        Lists all identities. Does not support search at the moment.

        Learn how identities work in [Ory Kratos' User And Identity Model Documentation](https://www.ory.sh/docs/next/kratos/concepts/identity-user-model).
      operationId: adminListIdentities
      parameters:
      - description: |-
          Items per Page

          This is the number of items per page.
        explode: true
        in: query
        name: per_page
        required: false
        schema:
          default: 250
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
        style: form
      - description: Pagination Page
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          format: int64
          minimum: 1
          type: integer
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/identityList'
          description: identityList
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: List Identities
      tags:
      - v0alpha2
    post:
      description: |-
        This endpoint creates an identity. It is NOT possible to set an identity's credentials (password, ...)
        using this method! A way to achieve that will be introduced in the future.

        Learn how identities work in [Ory Kratos' User And Identity Model Documentation](https://www.ory.sh/docs/next/kratos/concepts/identity-user-model).
      operationId: adminCreateIdentity
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/adminCreateIdentityBody'
        x-originalParamName: Body
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/identity'
          description: identity
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "409":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: Create an Identity
      tags:
      - v0alpha2
  /admin/identities/{id}:
    delete:
      description: |-
        Calling this endpoint irrecoverably and permanently deletes the identity given its ID. This action can not be undone.
        This endpoint returns 204 when the identity was deleted or when the identity was not found, in which case it is
        assumed that is has been deleted already.

        Learn how identities work in [Ory Kratos' User And Identity Model Documentation](https://www.ory.sh/docs/next/kratos/concepts/identity-user-model).
      operationId: adminDeleteIdentity
      parameters:
      - description: ID is the identity's ID.
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      responses:
        "204":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: Delete an Identity
      tags:
      - v0alpha2
    get:
      description: Learn how identities work in [Ory Kratos' User And Identity Model
        Documentation](https://www.ory.sh/docs/next/kratos/concepts/identity-user-model).
      operationId: adminGetIdentity
      parameters:
      - description: ID must be set to the ID of identity you want to get
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      - description: |-
          DeclassifyCredentials will declassify one or more identity's credentials

          Currently, only `oidc` is supported. This will return the initial OAuth 2.0 Access,
          Refresh and (optionally) OpenID Connect ID Token.
        explode: true
        in: query
        name: include_credential
        required: false
        schema:
          items:
            type: string
          type: array
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/identity'
          description: identity
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: Get an Identity
      tags:
      - v0alpha2
    put:
      description: |-
        This endpoint updates an identity. It is NOT possible to set an identity's credentials (password, ...)
        using this method! A way to achieve that will be introduced in the future.

        The full identity payload (except credentials) is expected. This endpoint does not support patching.

        Learn how identities work in [Ory Kratos' User And Identity Model Documentation](https://www.ory.sh/docs/next/kratos/concepts/identity-user-model).
      operationId: adminUpdateIdentity
      parameters:
      - description: ID must be set to the ID of identity you want to update
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdminUpdateIdentityBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/identity'
          description: identity
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "409":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: Update an Identity
      tags:
      - v0alpha2
  /admin/identities/{id}/sessions:
    delete:
      description: |-
        This endpoint is useful for:

        To forcefully logout Identity from all devices and sessions
      operationId: adminDeleteIdentitySessions
      parameters:
      - description: ID is the identity's ID.
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      responses:
        "204":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: Calling this endpoint irrecoverably and permanently deletes and invalidates
        all sessions that belong to the given Identity.
      tags:
      - v0alpha2
    get:
      description: |-
        This endpoint is useful for:

        Listing all sessions that belong to an Identity in an administrative context.
      operationId: adminListIdentitySessions
      parameters:
      - description: ID is the identity's ID.
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      - description: |-
          Items per Page

          This is the number of items per page.
        explode: true
        in: query
        name: per_page
        required: false
        schema:
          default: 250
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
        style: form
      - description: Pagination Page
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          format: int64
          minimum: 1
          type: integer
        style: form
      - description: Active is a boolean flag that filters out sessions based on the
          state. If no value is provided, all sessions are returned.
        explode: true
        in: query
        name: active
        required: false
        schema:
          type: boolean
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sessionList'
          description: sessionList
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - oryAccessToken: []
      summary: This endpoint returns all sessions that belong to the given Identity.
      tags:
      - v0alpha2
  /admin/recovery/link:
    post:
      description: |-
        This endpoint creates a recovery link which should be given to the user in order for them to recover
        (or activate) their account.
      operationId: adminCreateSelfServiceRecoveryLink
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/adminCreateSelfServiceRecoveryLinkBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryLink'
          description: selfServiceRecoveryLink
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Create a Recovery Link
      tags:
      - v0alpha2
  /health/alive:
    get:
      description: |-
        This endpoint returns a HTTP 200 status code when Ory Kratos is accepting incoming
        HTTP requests. This status does currently not include checks whether the database connection is working.

        If the service supports TLS Edge Termination, this endpoint does not require the
        `X-Forwarded-Proto` header to be set.

        Be aware that if you are running multiple nodes of this service, the health status will never
        refer to the cluster state, only to a single instance.
      operationId: isAlive
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_200'
          description: Ory Kratos is ready to accept connections.
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/genericError'
          description: genericError
      summary: Check HTTP Server Status
      tags:
      - metadata
  /health/ready:
    get:
      description: |-
        This endpoint returns a HTTP 200 status code when Ory Kratos is up running and the environment dependencies (e.g.
        the database) are responsive as well.

        If the service supports TLS Edge Termination, this endpoint does not require the
        `X-Forwarded-Proto` header to be set.

        Be aware that if you are running multiple nodes of Ory Kratos, the health status will never
        refer to the cluster state, only to a single instance.
      operationId: isReady
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_200'
          description: Ory Kratos is ready to accept requests.
        "503":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_503'
          description: Ory Kratos is not yet ready to accept requests.
      summary: Check HTTP Server and Database Status
      tags:
      - metadata
  /schemas:
    get:
      description: Get all Identity Schemas
      operationId: listIdentitySchemas
      parameters:
      - description: |-
          Items per Page

          This is the number of items per page.
        explode: true
        in: query
        name: per_page
        required: false
        schema:
          default: 250
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
        style: form
      - description: Pagination Page
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          format: int64
          minimum: 1
          type: integer
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/identitySchemas'
          description: identitySchemas
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      tags:
      - v0alpha2
  /schemas/{id}:
    get:
      description: Get a JSON Schema
      operationId: getJsonSchema
      parameters:
      - description: ID must be set to the ID of schema you want to get
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonSchema'
          description: jsonSchema
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      tags:
      - v0alpha2
  /self-service/errors:
    get:
      description: |-
        This endpoint returns the error associated with a user-facing self service errors.

        This endpoint supports stub values to help you implement the error UI:

        `?id=stub:500` - returns a stub 500 (Internal Server Error) error.

        More information can be found at [Ory Kratos User User Facing Error Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors).
      operationId: getSelfServiceError
      parameters:
      - description: Error is the error's ID
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceError'
          description: selfServiceError
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Self-Service Errors
      tags:
      - v0alpha2
  /self-service/login:
    post:
      description: |-
        :::info

        This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

        :::

        Use this endpoint to complete a login flow. This endpoint
        behaves differently for API and browser flows.

        API flows expect `application/json` to be sent in the body and responds with
        HTTP 200 and a application/json body with the session token on success;
        HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
        HTTP 400 on form validation errors.

        Browser flows expect a Content-Type of `application/x-www-form-urlencoded` or `application/json` to be sent in the body and respond with
        a HTTP 303 redirect to the post/after login URL or the `return_to` value if it was set and if the login succeeded;
        a HTTP 303 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

        Browser flows with an accept header of `application/json` will not redirect but instead respond with
        HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
        HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
        HTTP 400 on form validation errors.

        If this endpoint is called with `Accept: application/json` in the header, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!
        `browser_location_change_required`: Usually sent when an AJAX request indicates that the browser needs to open a specific URL.
        Most likely used in Social Sign In flows.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: submitSelfServiceLoginFlow
      parameters:
      - description: |-
          The Login Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/login?flow=abcde`).
        explode: true
        in: query
        name: flow
        required: true
        schema:
          type: string
        style: form
      - description: The Session Token of the Identity performing the settings flow.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceLoginFlowBody'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/submitSelfServiceLoginFlowBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/successfulSelfServiceLoginWithoutBrowser'
          description: successfulSelfServiceLoginWithoutBrowser
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceLoginFlow'
          description: selfServiceLoginFlow
        "422":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceBrowserLocationChangeRequiredError'
          description: selfServiceBrowserLocationChangeRequiredError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Submit a Login Flow
      tags:
      - v0alpha2
  /self-service/login/api:
    get:
      description: |-
        This endpoint initiates a login flow for API clients that do not use a browser, such as mobile devices, smart TVs, and so on.

        If a valid provided session cookie or session token is provided, a 400 Bad Request error
        will be returned unless the URL query parameter `?refresh=true` is set.

        To fetch an existing login flow call `/self-service/login/flows?flow=<flow_id>`.

        You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
        Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
        you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

        In the case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `session_aal1_required`: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.

        This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: initializeSelfServiceLoginFlowWithoutBrowser
      parameters:
      - description: |-
          Refresh a login session

          If set to true, this will refresh an existing login session by
          asking the user to sign in again. This will reset the
          authenticated_at time of the session.
        explode: true
        in: query
        name: refresh
        required: false
        schema:
          type: boolean
        style: form
      - description: |-
          Request a Specific AuthenticationMethod Assurance Level

          Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This
          allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password,
          the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ...
          you would set this to "aal2".
        explode: true
        in: query
        name: aal
        required: false
        schema:
          type: string
        style: form
      - description: The Session Token of the Identity performing the settings flow.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceLoginFlow'
          description: selfServiceLoginFlow
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Login Flow for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/login/browser:
    get:
      description: |-
        This endpoint initializes a browser-based user login flow. This endpoint will set the appropriate
        cookies and anti-CSRF measures required for browser-based flows.

        If this endpoint is opened as a link in the browser, it will be redirected to
        `selfservice.flows.login.ui_url` with the flow ID set as the query parameter `?flow=`. If a valid user session
        exists already, the browser will be redirected to `urls.default_redirect_url` unless the query parameter
        `?refresh=true` was set.

        If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `session_aal1_required`: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!

        This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: initializeSelfServiceLoginFlowForBrowsers
      parameters:
      - description: |-
          Refresh a login session

          If set to true, this will refresh an existing login session by
          asking the user to sign in again. This will reset the
          authenticated_at time of the session.
        explode: true
        in: query
        name: refresh
        required: false
        schema:
          type: boolean
        style: form
      - description: |-
          Request a Specific AuthenticationMethod Assurance Level

          Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This
          allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password,
          the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ...
          you would set this to "aal2".
        explode: true
        in: query
        name: aal
        required: false
        schema:
          type: string
        style: form
      - description: The URL to return the browser to after the flow was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceLoginFlow'
          description: selfServiceLoginFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Login Flow for Browsers
      tags:
      - v0alpha2
  /self-service/login/flows:
    get:
      description: |-
        This endpoint returns a login flow's context with, for example, error details and other information.

        Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header.
        For AJAX requests you must ensure that cookies are included in the request or requests will fail.

        If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain
        and you need to forward the incoming HTTP Cookie header to this endpoint:

        ```js
        pseudo-code example
        router.get('/login', async function (req, res) {
        const flow = await client.getSelfServiceLoginFlow(req.header('cookie'), req.query['flow'])

        res.render('login', flow)
        })
        ```

        This request may fail due to several reasons. The `error.id` can be one of:

        `session_already_available`: The user is already signed in.
        `self_service_flow_expired`: The flow is expired and you should request a new one.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: getSelfServiceLoginFlow
      parameters:
      - description: |-
          The Login Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/login?flow=abcde`).
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      - description: |-
          HTTP Cookies

          When using the SDK on the server side you must include the HTTP Cookie Header
          originally sent to your HTTP handler here.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceLoginFlow'
          description: selfServiceLoginFlow
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "410":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Login Flow
      tags:
      - v0alpha2
  /self-service/logout:
    get:
      description: |-
        This endpoint logs out an identity in a self-service manner.

        If the `Accept` HTTP header is not set to `application/json`, the browser will be redirected (HTTP 303 See Other)
        to the `return_to` parameter of the initial request or fall back to `urls.default_return_to`.

        If the `Accept` HTTP header is set to `application/json`, a 204 No Content response
        will be sent on successful logout instead.

        This endpoint is NOT INTENDED for API clients and only works
        with browsers (Chrome, Firefox, ...). For API clients you can
        call the `/self-service/logout/api` URL directly with the Ory Session Token.

        More information can be found at [Ory Kratos User Logout Documentation](https://www.ory.sh/docs/next/kratos/self-service/flows/user-logout).
      operationId: submitSelfServiceLogoutFlow
      parameters:
      - description: |-
          A Valid Logout Token

          If you do not have a logout token because you only have a session cookie,
          call `/self-service/logout/urls` to generate a URL for this endpoint.
        explode: true
        in: query
        name: token
        required: false
        schema:
          type: string
        style: form
      - description: The URL to return to after the logout was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "204":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Complete Self-Service Logout
      tags:
      - v0alpha2
  /self-service/logout/api:
    delete:
      description: |-
        Use this endpoint to log out an identity using an Ory Session Token. If the Ory Session Token was successfully
        revoked, the server returns a 204 No Content response. A 204 No Content response is also sent when
        the Ory Session Token has been revoked already before.

        If the Ory Session Token is malformed or does not exist a 403 Forbidden response will be returned.

        This endpoint does not remove any HTTP
        Cookies - use the Browser-Based Self-Service Logout Flow instead.
      operationId: submitSelfServiceLogoutFlowWithoutBrowser
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceLogoutFlowWithoutBrowserBody'
        required: true
        x-originalParamName: Body
      responses:
        "204":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Perform Logout for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/logout/browser:
    get:
      description: |-
        This endpoint initializes a browser-based user logout flow and a URL which can be used to log out the user.

        This endpoint is NOT INTENDED for API clients and only works
        with browsers (Chrome, Firefox, ...). For API clients you can
        call the `/self-service/logout/api` URL directly with the Ory Session Token.

        The URL is only valid for the currently signed in user. If no user is signed in, this endpoint returns
        a 401 error.

        When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.
      operationId: createSelfServiceLogoutFlowUrlForBrowsers
      parameters:
      - description: |-
          HTTP Cookies

          If you call this endpoint from a backend, please include the
          original Cookie header in the request.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceLogoutUrl'
          description: selfServiceLogoutUrl
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Create a Logout URL for Browsers
      tags:
      - v0alpha2
  /self-service/recovery:
    post:
      description: |-
        Use this endpoint to complete a recovery flow. This endpoint
        behaves differently for API and browser flows and has several states:

        `choose_method` expects `flow` (in the URL query) and `email` (in the body) to be sent
        and works with API- and Browser-initiated flows.
        For API clients and Browser clients with HTTP Header `Accept: application/json` it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid.
        and a HTTP 303 See Other redirect with a fresh recovery flow if the flow was otherwise invalid (e.g. expired).
        For Browser clients without HTTP Header `Accept` or with `Accept: text/*` it returns a HTTP 303 See Other redirect to the Recovery UI URL with the Recovery Flow ID appended.
        `sent_email` is the success state after `choose_method` for the `link` method and allows the user to request another recovery email. It
        works for both API and Browser-initiated flows and returns the same responses as the flow in `choose_method` state.
        `passed_challenge` expects a `token` to be sent in the URL query and given the nature of the flow ("sending a recovery link")
        does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL
        (if the link was valid) and instructs the user to update their password, or a redirect to the Recover UI URL with
        a new Recovery Flow ID which contains an error message that the recovery link was invalid.

        More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
      operationId: submitSelfServiceRecoveryFlow
      parameters:
      - description: |-
          The Recovery Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/recovery?flow=abcde`).
        explode: true
        in: query
        name: flow
        required: true
        schema:
          type: string
        style: form
      - description: |-
          Recovery Token

          The recovery token which completes the recovery request. If the token
          is invalid (e.g. expired) an error will be shown to the end-user.

          This parameter is usually set in a link and not used by any direct API call.
        explode: true
        in: query
        name: token
        required: false
        schema:
          type: string
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceRecoveryFlowBody'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/submitSelfServiceRecoveryFlowBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryFlow'
          description: selfServiceRecoveryFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryFlow'
          description: selfServiceRecoveryFlow
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Complete Recovery Flow
      tags:
      - v0alpha2
  /self-service/recovery/api:
    get:
      description: |-
        This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on.

        If a valid provided session cookie or session token is provided, a 400 Bad Request error.

        To fetch an existing recovery flow call `/self-service/recovery/flows?flow=<flow_id>`.

        You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
        Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
        you vulnerable to a variety of CSRF attacks.

        This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).


        More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
      operationId: initializeSelfServiceRecoveryFlowWithoutBrowser
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryFlow'
          description: selfServiceRecoveryFlow
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Recovery Flow for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/recovery/browser:
    get:
      description: |-
        This endpoint initializes a browser-based account recovery flow. Once initialized, the browser will be redirected to
        `selfservice.flows.recovery.ui_url` with the flow ID set as the query parameter `?flow=`. If a valid user session
        exists, the browser is returned to the configured return URL.

        If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects
        or a 400 bad request error if the user is already authenticated.

        This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

        More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
      operationId: initializeSelfServiceRecoveryFlowForBrowsers
      parameters:
      - description: The URL to return the browser to after the flow was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryFlow'
          description: selfServiceRecoveryFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Recovery Flow for Browsers
      tags:
      - v0alpha2
  /self-service/recovery/flows:
    get:
      description: |-
        This endpoint returns a recovery flow's context with, for example, error details and other information.

        Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header.
        For AJAX requests you must ensure that cookies are included in the request or requests will fail.

        If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain
        and you need to forward the incoming HTTP Cookie header to this endpoint:

        ```js
        pseudo-code example
        router.get('/recovery', async function (req, res) {
        const flow = await client.getSelfServiceRecoveryFlow(req.header('Cookie'), req.query['flow'])

        res.render('recovery', flow)
        })
        ```

        More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).
      operationId: getSelfServiceRecoveryFlow
      parameters:
      - description: |-
          The Flow ID

          The value for this parameter comes from `request` URL Query parameter sent to your
          application (e.g. `/recovery?flow=abcde`).
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      - description: |-
          HTTP Cookies

          When using the SDK on the server side you must include the HTTP Cookie Header
          originally sent to your HTTP handler here.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRecoveryFlow'
          description: selfServiceRecoveryFlow
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "410":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Recovery Flow
      tags:
      - v0alpha2
  /self-service/registration:
    post:
      description: |-
        Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint
        behaves differently for API and browser flows.

        API flows expect `application/json` to be sent in the body and respond with
        HTTP 200 and a application/json body with the created identity success - if the session hook is configured the
        `session` and `session_token` will also be included;
        HTTP 303 redirect to a fresh registration flow if the original flow expired with the appropriate error messages set;
        HTTP 400 on form validation errors.

        Browser flows expect a Content-Type of `application/x-www-form-urlencoded` or `application/json` to be sent in the body and respond with
        a HTTP 303 redirect to the post/after registration URL or the `return_to` value if it was set and if the registration succeeded;
        a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

        Browser flows with an accept header of `application/json` will not redirect but instead respond with
        HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
        HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
        HTTP 400 on form validation errors.

        If this endpoint is called with `Accept: application/json` in the header, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!
        `browser_location_change_required`: Usually sent when an AJAX request indicates that the browser needs to open a specific URL.
        Most likely used in Social Sign In flows.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: submitSelfServiceRegistrationFlow
      parameters:
      - description: |-
          The Registration Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/registration?flow=abcde`).
        explode: true
        in: query
        name: flow
        required: true
        schema:
          type: string
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceRegistrationFlowBody'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/submitSelfServiceRegistrationFlowBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/successfulSelfServiceRegistrationWithoutBrowser'
          description: successfulSelfServiceRegistrationWithoutBrowser
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRegistrationFlow'
          description: selfServiceRegistrationFlow
        "422":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceBrowserLocationChangeRequiredError'
          description: selfServiceBrowserLocationChangeRequiredError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Submit a Registration Flow
      tags:
      - v0alpha2
  /self-service/registration/api:
    get:
      description: |-
        This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on.

        If a valid provided session cookie or session token is provided, a 400 Bad Request error
        will be returned unless the URL query parameter `?refresh=true` is set.

        To fetch an existing registration flow call `/self-service/registration/flows?flow=<flow_id>`.

        You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
        Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
        you vulnerable to a variety of CSRF attacks.

        In the case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.

        This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: initializeSelfServiceRegistrationFlowWithoutBrowser
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRegistrationFlow'
          description: selfServiceRegistrationFlow
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Registration Flow for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/registration/browser:
    get:
      description: |-
        This endpoint initializes a browser-based user registration flow. This endpoint will set the appropriate
        cookies and anti-CSRF measures required for browser-based flows.

        :::info

        This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

        :::

        If this endpoint is opened as a link in the browser, it will be redirected to
        `selfservice.flows.registration.ui_url` with the flow ID set as the query parameter `?flow=`. If a valid user session
        exists already, the browser will be redirected to `urls.default_redirect_url`.

        If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `session_already_available`: The user is already signed in.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!

        If this endpoint is called via an AJAX request, the response contains the registration flow without a redirect.

        This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: initializeSelfServiceRegistrationFlowForBrowsers
      parameters:
      - description: The URL to return the browser to after the flow was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRegistrationFlow'
          description: selfServiceRegistrationFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Registration Flow for Browsers
      tags:
      - v0alpha2
  /self-service/registration/flows:
    get:
      description: |-
        This endpoint returns a registration flow's context with, for example, error details and other information.

        Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header.
        For AJAX requests you must ensure that cookies are included in the request or requests will fail.

        If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain
        and you need to forward the incoming HTTP Cookie header to this endpoint:

        ```js
        pseudo-code example
        router.get('/registration', async function (req, res) {
        const flow = await client.getSelfServiceRegistrationFlow(req.header('cookie'), req.query['flow'])

        res.render('registration', flow)
        })
        ```

        This request may fail due to several reasons. The `error.id` can be one of:

        `session_already_available`: The user is already signed in.
        `self_service_flow_expired`: The flow is expired and you should request a new one.

        More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).
      operationId: getSelfServiceRegistrationFlow
      parameters:
      - description: |-
          The Registration Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/registration?flow=abcde`).
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      - description: |-
          HTTP Cookies

          When using the SDK on the server side you must include the HTTP Cookie Header
          originally sent to your HTTP handler here.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceRegistrationFlow'
          description: selfServiceRegistrationFlow
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "410":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Registration Flow
      tags:
      - v0alpha2
  /self-service/settings:
    post:
      description: |-
        Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint
        behaves differently for API and browser flows.

        API-initiated flows expect `application/json` to be sent in the body and respond with
        HTTP 200 and an application/json body with the session token on success;
        HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set;
        HTTP 400 on form validation errors.
        HTTP 401 when the endpoint is called without a valid session token.
        HTTP 403 when `selfservice.flows.settings.privileged_session_max_age` was reached or the session's AAL is too low.
        Implies that the user needs to re-authenticate.

        Browser flows without HTTP Header `Accept` or with `Accept: text/*` respond with
        a HTTP 303 redirect to the post/after settings URL or the `return_to` value if it was set and if the flow succeeded;
        a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise.
        a HTTP 303 redirect to the login endpoint when `selfservice.flows.settings.privileged_session_max_age` was reached or the session's AAL is too low.

        Browser flows with HTTP Header `Accept: application/json` respond with
        HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
        HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
        HTTP 401 when the endpoint is called without a valid session cookie.
        HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low.
        HTTP 400 on form validation errors.

        Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
        Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
        credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
        to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

        If this endpoint is called with a `Accept: application/json` HTTP header, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `session_refresh_required`: The identity requested to change something that needs a privileged session. Redirect
        the identity to the login init endpoint with query parameters `?refresh=true&return_to=<the-current-browser-url>`,
        or initiate a refresh login flow otherwise.
        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `session_inactive`: No Ory Session was found - sign in a user first.
        `security_identity_mismatch`: The flow was interrupted with `session_refresh_required` but apparently some other
        identity logged in instead.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!
        `browser_location_change_required`: Usually sent when an AJAX request indicates that the browser needs to open a specific URL.
        Most likely used in Social Sign In flows.

        More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
      operationId: submitSelfServiceSettingsFlow
      parameters:
      - description: |-
          The Settings Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/settings?flow=abcde`).
        explode: true
        in: query
        name: flow
        required: true
        schema:
          type: string
        style: form
      - description: The Session Token of the Identity performing the settings flow.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceSettingsFlowBody'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/submitSelfServiceSettingsFlowBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceSettingsFlow'
          description: selfServiceSettingsFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceSettingsFlow'
          description: selfServiceSettingsFlow
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "422":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceBrowserLocationChangeRequiredError'
          description: selfServiceBrowserLocationChangeRequiredError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      security:
      - sessionToken: []
      summary: Complete Settings Flow
      tags:
      - v0alpha2
  /self-service/settings/api:
    get:
      description: |-
        This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on.
        You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

        To fetch an existing settings flow call `/self-service/settings/flows?flow=<flow_id>`.

        You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
        Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
        you vulnerable to a variety of CSRF attacks.

        Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
        Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
        credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
        to sign in with the second factor or change the configuration.

        In the case of an error, the `error.id` of the JSON response body can be one of:

        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `session_inactive`: No Ory Session was found - sign in a user first.

        This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

        More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
      operationId: initializeSelfServiceSettingsFlowWithoutBrowser
      parameters:
      - description: The Session Token of the Identity performing the settings flow.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceSettingsFlow'
          description: selfServiceSettingsFlow
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Settings Flow for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/settings/browser:
    get:
      description: |-
        This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to
        `selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid
        Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

        If this endpoint is opened as a link in the browser, it will be redirected to
        `selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid user session
        was set, the browser will be redirected to the login endpoint.

        If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects
        or a 401 forbidden error if no valid session was set.

        Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
        Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
        credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
        to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

        If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `session_inactive`: No Ory Session was found - sign in a user first.
        `security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!

        This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

        More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
      operationId: initializeSelfServiceSettingsFlowForBrowsers
      parameters:
      - description: The URL to return the browser to after the flow was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceSettingsFlow'
          description: selfServiceSettingsFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Settings Flow for Browsers
      tags:
      - v0alpha2
  /self-service/settings/flows:
    get:
      description: |-
        When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie
        or the Ory Kratos Session Token are set.

        Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
        Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
        credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
        to sign in with the second factor or change the configuration.

        You can access this endpoint without credentials when using Ory Kratos' Admin API.

        If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
        case of an error, the `error.id` of the JSON response body can be one of:

        `security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
        `session_inactive`: No Ory Session was found - sign in a user first.
        `security_identity_mismatch`: The flow was interrupted with `session_refresh_required` but apparently some other
        identity logged in instead.

        More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).
      operationId: getSelfServiceSettingsFlow
      parameters:
      - description: |-
          ID is the Settings Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/settings?flow=abcde`).
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      - description: |-
          The Session Token

          When using the SDK in an app without a browser, please include the
          session token here.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      - description: |-
          HTTP Cookies

          When using the SDK on the server side you must include the HTTP Cookie Header
          originally sent to your HTTP handler here. You only need to do this for browser-
          based flows.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceSettingsFlow'
          description: selfServiceSettingsFlow
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "410":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Settings Flow
      tags:
      - v0alpha2
  /self-service/verification:
    post:
      description: |-
        Use this endpoint to complete a verification flow. This endpoint
        behaves differently for API and browser flows and has several states:

        `choose_method` expects `flow` (in the URL query) and `email` (in the body) to be sent
        and works with API- and Browser-initiated flows.
        For API clients and Browser clients with HTTP Header `Accept: application/json` it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid
        and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired).
        For Browser clients without HTTP Header `Accept` or with `Accept: text/*` it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended.
        `sent_email` is the success state after `choose_method` when using the `link` method and allows the user to request another verification email. It
        works for both API and Browser-initiated flows and returns the same responses as the flow in `choose_method` state.
        `passed_challenge` expects a `token` to be sent in the URL query and given the nature of the flow ("sending a verification link")
        does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL
        (if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with
        a new Verification Flow ID which contains an error message that the verification link was invalid.

        More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).
      operationId: submitSelfServiceVerificationFlow
      parameters:
      - description: |-
          The Verification Flow ID

          The value for this parameter comes from `flow` URL Query parameter sent to your
          application (e.g. `/verification?flow=abcde`).
        explode: true
        in: query
        name: flow
        required: true
        schema:
          type: string
        style: form
      - description: |-
          Verification Token

          The verification token which completes the verification request. If the token
          is invalid (e.g. expired) an error will be shown to the end-user.

          This parameter is usually set in a link and not used by any direct API call.
        explode: true
        in: query
        name: token
        required: false
        schema:
          type: string
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/submitSelfServiceVerificationFlowBody'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/submitSelfServiceVerificationFlowBody'
        x-originalParamName: Body
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceVerificationFlow'
          description: selfServiceVerificationFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceVerificationFlow'
          description: selfServiceVerificationFlow
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Complete Verification Flow
      tags:
      - v0alpha2
  /self-service/verification/api:
    get:
      description: |-
        This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.

        To fetch an existing verification flow call `/self-service/verification/flows?flow=<flow_id>`.

        You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
        Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
        you vulnerable to a variety of CSRF attacks.

        This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

        More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).
      operationId: initializeSelfServiceVerificationFlowWithoutBrowser
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceVerificationFlow'
          description: selfServiceVerificationFlow
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Verification Flow for APIs, Services, Apps, ...
      tags:
      - v0alpha2
  /self-service/verification/browser:
    get:
      description: |-
        This endpoint initializes a browser-based account verification flow. Once initialized, the browser will be redirected to
        `selfservice.flows.verification.ui_url` with the flow ID set as the query parameter `?flow=`.

        If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects.

        This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...).

        More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).
      operationId: initializeSelfServiceVerificationFlowForBrowsers
      parameters:
      - description: The URL to return the browser to after the flow was completed.
        explode: true
        in: query
        name: return_to
        required: false
        schema:
          type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceVerificationFlow'
          description: selfServiceVerificationFlow
        "303":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Initialize Verification Flow for Browser Clients
      tags:
      - v0alpha2
  /self-service/verification/flows:
    get:
      description: |-
        This endpoint returns a verification flow's context with, for example, error details and other information.

        Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header.
        For AJAX requests you must ensure that cookies are included in the request or requests will fail.

        If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain
        and you need to forward the incoming HTTP Cookie header to this endpoint:

        ```js
        pseudo-code example
        router.get('/recovery', async function (req, res) {
        const flow = await client.getSelfServiceVerificationFlow(req.header('cookie'), req.query['flow'])

        res.render('verification', flow)
        })

        More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).
      operationId: getSelfServiceVerificationFlow
      parameters:
      - description: |-
          The Flow ID

          The value for this parameter comes from `request` URL Query parameter sent to your
          application (e.g. `/verification?flow=abcde`).
        explode: true
        in: query
        name: id
        required: true
        schema:
          type: string
        style: form
      - description: |-
          HTTP Cookies

          When using the SDK on the server side you must include the HTTP Cookie Header
          originally sent to your HTTP handler here.
        explode: false
        in: header
        name: cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/selfServiceVerificationFlow'
          description: selfServiceVerificationFlow
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Get Verification Flow
      tags:
      - v0alpha2
  /sessions:
    delete:
      description: |-
        This endpoint is useful for:

        To forcefully logout the current user from all other devices and sessions
      operationId: revokeSessions
      parameters:
      - description: Set the Session Token when calling from non-browser clients.
          A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      - description: |-
          Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that
          scenario you must include the HTTP Cookie Header which originally was included in the request to your server.
          An example of a session in the HTTP Cookie Header is: `ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==`.

          It is ok if more than one cookie are included here as all other cookies will be ignored.
        explode: false
        in: header
        name: Cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/revokedSessions'
          description: revokedSessions
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: |-
        Calling this endpoint invalidates all except the current session that belong to the logged-in user.
        Session data are not deleted.
      tags:
      - v0alpha2
    get:
      description: |-
        This endpoint is useful for:

        Displaying all other sessions that belong to the logged-in user
      operationId: listSessions
      parameters:
      - description: Set the Session Token when calling from non-browser clients.
          A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`.
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      - description: |-
          Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that
          scenario you must include the HTTP Cookie Header which originally was included in the request to your server.
          An example of a session in the HTTP Cookie Header is: `ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==`.

          It is ok if more than one cookie are included here as all other cookies will be ignored.
        explode: false
        in: header
        name: Cookie
        required: false
        schema:
          type: string
        style: simple
      - description: |-
          Items per Page

          This is the number of items per page.
        explode: true
        in: query
        name: per_page
        required: false
        schema:
          default: 250
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
        style: form
      - description: Pagination Page
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          format: int64
          minimum: 1
          type: integer
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sessionList'
          description: sessionList
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "404":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: |-
        This endpoints returns all other active sessions that belong to the logged-in user.
        The current session can be retrieved by calling the `/sessions/whoami` endpoint.
      tags:
      - v0alpha2
  /sessions/whoami:
    get:
      description: |-
        Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated.
        Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent.
        Additionally when the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

        If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

        ```js
        pseudo-code example
        router.get('/protected-endpoint', async function (req, res) {
        const session = await client.toSession(undefined, req.header('cookie'))

        console.log(session)
        })
        ```

        When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

        ```js
        pseudo-code example
        ...
        const session = await client.toSession("the-session-token")

        console.log(session)
        ```

        Depending on your configuration this endpoint might return a 403 status code if the session has a lower Authenticator
        Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
        credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
        to sign in with the second factor or change the configuration.

        This endpoint is useful for:

        AJAX calls. Remember to send credentials and set up CORS correctly!
        Reverse proxies and API Gateways
        Server-side calls - use the `X-Session-Token` header!

        This endpoint authenticates users by checking

        if the `Cookie` HTTP header was set containing an Ory Kratos Session Cookie;
        if the `Authorization: bearer <ory-session-token>` HTTP header was set with a valid Ory Kratos Session Token;
        if the `X-Session-Token` HTTP header was set with a valid Ory Kratos Session Token.

        If none of these headers are set or the cooke or token are invalid, the endpoint returns a HTTP 401 status code.

        As explained above, this request may fail due to several reasons. The `error.id` can be one of:

        `session_inactive`: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token).
        `session_aal2_required`: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.
      operationId: toSession
      parameters:
      - description: Set the Session Token when calling from non-browser clients.
          A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`.
        example: MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj
        explode: false
        in: header
        name: X-Session-Token
        required: false
        schema:
          type: string
        style: simple
      - description: |-
          Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that
          scenario you must include the HTTP Cookie Header which originally was included in the request to your server.
          An example of a session in the HTTP Cookie Header is: `ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==`.

          It is ok if more than one cookie are included here as all other cookies will be ignored.
        example: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==
        explode: false
        in: header
        name: Cookie
        required: false
        schema:
          type: string
        style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/session'
          description: session
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "403":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: Check Who the Current HTTP Session Belongs To
      tags:
      - v0alpha2
  /sessions/{id}:
    delete:
      description: |-
        This endpoint is useful for:

        To forcefully logout the current user from another device or session
      operationId: revokeSession
      parameters:
      - description: ID is the session's ID.
        explode: false
        in: path
        name: id
        required: true
        schema:
          type: string
        style: simple
      responses:
        "204":
          description: Empty responses are sent when, for example, resources are deleted.
            The HTTP status code for empty responses is typically 201.
        "400":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "401":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
        "500":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonError'
          description: jsonError
      summary: |-
        Calling this endpoint invalidates the specified session. The current session cannot be revoked.
        Session data are not deleted.
      tags:
      - v0alpha2
  /version:
    get:
      description: |-
        This endpoint returns the version of Ory Kratos.

        If the service supports TLS Edge Termination, this endpoint does not require the
        `X-Forwarded-Proto` header to be set.

        Be aware that if you are running multiple nodes of this service, the version will never
        refer to the cluster state, only to a single instance.
      operationId: getVersion
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_200_1'
          description: Returns the Ory Kratos version.
      summary: Return Running Software Version.
      tags:
      - metadata
components:
  responses:
    emptyResponse:
      description: Empty responses are sent when, for example, resources are deleted.
        The HTTP status code for empty responses is typically 201.
  schemas:
    AdminUpdateIdentityBody:
      example:
        traits: '{}'
        schema_id: schema_id
      properties:
        schema_id:
          description: |-
            SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set
            will update the Identity's SchemaID.
          type: string
        state:
          $ref: '#/components/schemas/identityState'
        traits:
          description: |-
            Traits represent an identity's traits. The identity is able to create, modify, and delete traits
            in a self-service manner. The input will always be validated against the JSON Schema defined
            in `schema_id`.
          type: object
      required:
      - schema_id
      - state
      - traits
      type: object
    Duration:
      description: |-
        A Duration represents the elapsed time between two instants
        as an int64 nanosecond count. The representation limits the
        largest representable duration to approximately 290 years.
      format: int64
      type: integer
    ID:
      format: int64
      type: integer
    JSONRawMessage:
      title: JSONRawMessage represents a json.RawMessage that works well with JSON,
        SQL, and Swagger.
      type: object
    RecoveryAddress:
      example:
        updated_at: 2000-01-23T04:56:07.000+00:00
        created_at: 2000-01-23T04:56:07.000+00:00
        id: id
        value: value
        via: via
      properties:
        created_at:
          description: CreatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        updated_at:
          description: UpdatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        value:
          type: string
        via:
          type: string
      required:
      - id
      - value
      - via
      type: object
    RecoveryAddressType:
      type: string
    UUID:
      format: uuid4
      type: string
    adminCreateIdentityBody:
      properties:
        credentials:
          $ref: '#/components/schemas/adminIdentityImportCredentials'
        recovery_addresses:
          description: |-
            RecoveryAddresses contains all the addresses that can be used to recover an identity.

            Use this structure to import recovery addresses for an identity. Please keep in mind
            that the address needs to be represented in the Identity Schema or this field will be overwritten
            on the next identity update.
          items:
            $ref: '#/components/schemas/RecoveryAddress'
          type: array
        schema_id:
          description: SchemaID is the ID of the JSON Schema to be used for validating
            the identity's traits.
          type: string
        state:
          $ref: '#/components/schemas/identityState'
        traits:
          description: |-
            Traits represent an identity's traits. The identity is able to create, modify, and delete traits
            in a self-service manner. The input will always be validated against the JSON Schema defined
            in `schema_url`.
          type: object
        verifiable_addresses:
          description: |-
            VerifiableAddresses contains all the addresses that can be verified by the user.

            Use this structure to import verified addresses for an identity. Please keep in mind
            that the address needs to be represented in the Identity Schema or this field will be overwritten
            on the next identity update.
          items:
            $ref: '#/components/schemas/verifiableIdentityAddress'
          type: array
      required:
      - schema_id
      - traits
      type: object
    adminCreateIdentityImportCredentialsOidc:
      properties:
        config:
          $ref: '#/components/schemas/adminCreateIdentityImportCredentialsOidcConfig'
      type: object
    adminCreateIdentityImportCredentialsOidcConfig:
      properties:
        config:
          $ref: '#/components/schemas/adminCreateIdentityImportCredentialsPasswordConfig'
        providers:
          description: A list of OpenID Connect Providers
          items:
            $ref: '#/components/schemas/adminCreateIdentityImportCredentialsOidcProvider'
          type: array
      type: object
    adminCreateIdentityImportCredentialsOidcProvider:
      properties:
        provider:
          description: The OpenID Connect provider to link the subject to. Usually
            something like `google` or `github`.
          type: string
        subject:
          description: The subject (`sub`) of the OpenID Connect connection. Usually
            the `sub` field of the ID Token.
          type: string
      required:
      - provider
      - subject
      type: object
    adminCreateIdentityImportCredentialsPassword:
      properties:
        config:
          $ref: '#/components/schemas/adminCreateIdentityImportCredentialsPasswordConfig'
      type: object
    adminCreateIdentityImportCredentialsPasswordConfig:
      properties:
        hashed_password:
          description: The hashed password in [PHC format]( https://www.ory.sh/docs/kratos/concepts/credentials/username-email-password#hashed-password-format)
          type: string
        password:
          description: The password in plain text if no hash is available.
          type: string
      type: object
    adminCreateSelfServiceRecoveryLinkBody:
      properties:
        expires_in:
          description: |-
            Link Expires In

            The recovery link will expire at that point in time. Defaults to the configuration value of
            `selfservice.flows.recovery.request_lifespan`.
          pattern: ^[0-9]+(ns|us|ms|s|m|h)$
          type: string
        identity_id:
          format: uuid4
          type: string
      required:
      - identity_id
      type: object
    adminIdentityImportCredentials:
      properties:
        oidc:
          $ref: '#/components/schemas/adminCreateIdentityImportCredentialsOidc'
        password:
          $ref: '#/components/schemas/adminCreateIdentityImportCredentialsPassword'
      type: object
    authenticatorAssuranceLevel:
      description: |-
        The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder
        for an attacker to compromise the account.

        Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g.
        password + TOTP) have been used.

        To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials
      enum:
      - aal0
      - aal1
      - aal2
      - aal3
      title: Authenticator Assurance Level (AAL)
      type: string
    errorAuthenticatorAssuranceLevelNotSatisfied:
      properties:
        code:
          description: The status code
          example: 404
          format: int64
          type: integer
        debug:
          description: |-
            Debug information

            This field is often not exposed to protect against leaking
            sensitive information.
          example: SQL field "foo" is not a bool.
          type: string
        details:
          additionalProperties: true
          description: Further error details
          type: object
        id:
          description: |-
            The error ID

            Useful when trying to identify various errors in application logic.
          type: string
        message:
          description: |-
            Error message

            The error's message.
          example: The resource could not be found
          type: string
        reason:
          description: A human-readable reason for the error
          example: User with ID 1234 does not exist.
          type: string
        redirect_browser_to:
          type: string
        request:
          description: |-
            The request ID

            The request ID is often exposed internally in order to trace
            errors across service architectures. This is often a UUID.
          example: d7ef54b1-ec15-46e6-bccb-524b82c035e6
          type: string
        status:
          description: The status description
          example: Not Found
          type: string
      required:
      - message
      title: ErrAALNotSatisfied is returned when an active session was found but the
        requested AAL is not satisfied.
      type: object
    genericError:
      properties:
        code:
          description: The status code
          example: 404
          format: int64
          type: integer
        debug:
          description: |-
            Debug information

            This field is often not exposed to protect against leaking
            sensitive information.
          example: SQL field "foo" is not a bool.
          type: string
        details:
          additionalProperties: false
          description: Further error details
          type: object
        id:
          description: |-
            The error ID

            Useful when trying to identify various errors in application logic.
          type: string
        message:
          description: |-
            Error message

            The error's message.
          example: The resource could not be found
          type: string
        reason:
          description: A human-readable reason for the error
          example: User with ID 1234 does not exist.
          type: string
        request:
          description: |-
            The request ID

            The request ID is often exposed internally in order to trace
            errors across service architectures. This is often a UUID.
          example: d7ef54b1-ec15-46e6-bccb-524b82c035e6
          type: string
        status:
          description: The status description
          example: Not Found
          type: string
      required:
      - message
      type: object
    healthNotReadyStatus:
      properties:
        errors:
          additionalProperties:
            type: string
          description: Errors contains a list of errors that caused the not ready
            status.
          type: object
      type: object
    healthStatus:
      properties:
        status:
          description: Status always contains "ok".
          type: string
      type: object
    identity:
      description: |-
        An identity can be a real human, a service, an IoT device - everything that
        can be described as an "actor" in a system.
      example:
        recovery_addresses:
        - updated_at: 2000-01-23T04:56:07.000+00:00
          created_at: 2000-01-23T04:56:07.000+00:00
          id: id
          value: value
          via: via
        - updated_at: 2000-01-23T04:56:07.000+00:00
          created_at: 2000-01-23T04:56:07.000+00:00
          id: id
          value: value
          via: via
        traits: ""
        updated_at: 2000-01-23T04:56:07.000+00:00
        credentials:
          key:
            updated_at: 2000-01-23T04:56:07.000+00:00
            identifiers:
            - identifiers
            - identifiers
            created_at: 2000-01-23T04:56:07.000+00:00
            config: '{}'
            version: 0
        verifiable_addresses:
        - updated_at: 2014-01-01T23:28:56.782Z
          verified_at: 2000-01-23T04:56:07.000+00:00
          verified: true
          created_at: 2014-01-01T23:28:56.782Z
          id: id
          value: value
          status: status
          via: via
        - updated_at: 2014-01-01T23:28:56.782Z
          verified_at: 2000-01-23T04:56:07.000+00:00
          verified: true
          created_at: 2014-01-01T23:28:56.782Z
          id: id
          value: value
          status: status
          via: via
        schema_id: schema_id
        state_changed_at: 2000-01-23T04:56:07.000+00:00
        created_at: 2000-01-23T04:56:07.000+00:00
        schema_url: schema_url
        id: id
      properties:
        created_at:
          description: CreatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        credentials:
          additionalProperties:
            $ref: '#/components/schemas/identityCredentials'
          description: Credentials represents all credentials that can be used for
            authenticating this identity.
          type: object
        id:
          format: uuid4
          type: string
        recovery_addresses:
          description: RecoveryAddresses contains all the addresses that can be used
            to recover an identity.
          items:
            $ref: '#/components/schemas/RecoveryAddress'
          type: array
          x-omitempty: true
        schema_id:
          description: SchemaID is the ID of the JSON Schema to be used for validating
            the identity's traits.
          type: string
        schema_url:
          description: |-
            SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from.

            format: url
          type: string
        state:
          $ref: '#/components/schemas/identityState'
        state_changed_at:
          format: date-time
          title: NullTime implements sql.NullTime functionality.
          type: string
        traits:
          description: |-
            Traits represent an identity's traits. The identity is able to create, modify, and delete traits
            in a self-service manner. The input will always be validated against the JSON Schema defined
            in `schema_url`.
        updated_at:
          description: UpdatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        verifiable_addresses:
          description: VerifiableAddresses contains all the addresses that can be
            verified by the user.
          items:
            $ref: '#/components/schemas/verifiableIdentityAddress'
          type: array
          x-omitempty: true
      required:
      - id
      - schema_id
      - schema_url
      - traits
      title: Identity represents an Ory Kratos identity
      type: object
    identityCredentials:
      description: Credentials represents a specific credential type
      example:
        updated_at: 2000-01-23T04:56:07.000+00:00
        identifiers:
        - identifiers
        - identifiers
        created_at: 2000-01-23T04:56:07.000+00:00
        config: '{}'
        version: 0
      properties:
        config:
          title: JSONRawMessage represents a json.RawMessage that works well with
            JSON, SQL, and Swagger.
          type: object
        created_at:
          description: CreatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        identifiers:
          description: Identifiers represents a list of unique identifiers this credential
            type matches.
          items:
            type: string
          type: array
        type:
          $ref: '#/components/schemas/identityCredentialsType'
        updated_at:
          description: UpdatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        version:
          description: Version refers to the version of the credential. Useful when
            changing the config schema.
          format: int64
          type: integer
      type: object
    identityCredentialsOidc:
      properties:
        providers:
          items:
            $ref: '#/components/schemas/identityCredentialsOidcProvider'
          type: array
      title: CredentialsOIDC is contains the configuration for credentials of the
        type oidc.
      type: object
    identityCredentialsOidcProvider:
      properties:
        initial_access_token:
          type: string
        initial_id_token:
          type: string
        initial_refresh_token:
          type: string
        provider:
          type: string
        subject:
          type: string
      title: CredentialsOIDCProvider is contains a specific OpenID COnnect credential
        for a particular connection (e.g. Google).
      type: object
    identityCredentialsPassword:
      properties:
        hashed_password:
          description: HashedPassword is a hash-representation of the password.
          type: string
      title: CredentialsPassword is contains the configuration for credentials of
        the type password.
      type: object
    identityCredentialsType:
      description: and so on.
      enum:
      - password
      - totp
      - oidc
      - webauthn
      - lookup_secret
      title: CredentialsType  represents several different credential types, like
        password credentials, passwordless credentials,
      type: string
    identityList:
      items:
        $ref: '#/components/schemas/identity'
      title: A list of identities.
      type: array
    identitySchema:
      example:
        schema: '{}'
        id: id
      properties:
        id:
          description: The ID of the Identity JSON Schema
          type: string
        schema:
          description: The actual Identity JSON Schema
          type: object
      type: object
    identitySchemas:
      description: Raw identity Schema list
      items:
        $ref: '#/components/schemas/identitySchema'
      type: array
    identityState:
      description: The state can either be `active` or `inactive`.
      enum:
      - active
      - inactive
      title: An Identity's State
      type: string
    identityTraits:
      description: |-
        Traits represent an identity's traits. The identity is able to create, modify, and delete traits
        in a self-service manner. The input will always be validated against the JSON Schema defined
        in `schema_url`.
    identityVerifiableAddressStatus:
      description: VerifiableAddressStatus must not exceed 16 characters as that is
        the limitation in the SQL Schema
      type: string
    identityVerifiableAddressType:
      description: VerifiableAddressType must not exceed 16 characters as that is
        the limitation in the SQL Schema
      type: string
    jsonError:
      description: The standard Ory JSON API error format.
      properties:
        error:
          $ref: '#/components/schemas/genericError'
      required:
      - error
      title: JSON API Error Response
      type: object
    jsonSchema:
      description: Raw JSON Schema
      type: object
    needsPrivilegedSessionError:
      properties:
        code:
          description: The status code
          example: 404
          format: int64
          type: integer
        debug:
          description: |-
            Debug information

            This field is often not exposed to protect against leaking
            sensitive information.
          example: SQL field "foo" is not a bool.
          type: string
        details:
          additionalProperties: true
          description: Further error details
          type: object
        id:
          description: |-
            The error ID

            Useful when trying to identify various errors in application logic.
          type: string
        message:
          description: |-
            Error message

            The error's message.
          example: The resource could not be found
          type: string
        reason:
          description: A human-readable reason for the error
          example: User with ID 1234 does not exist.
          type: string
        redirect_browser_to:
          description: Points to where to redirect the user to next.
          type: string
        request:
          description: |-
            The request ID

            The request ID is often exposed internally in order to trace
            errors across service architectures. This is often a UUID.
          example: d7ef54b1-ec15-46e6-bccb-524b82c035e6
          type: string
        status:
          description: The status description
          example: Not Found
          type: string
      required:
      - message
      - redirect_browser_to
      title: Is sent when a privileged session is required to perform the settings
        update.
      type: object
    nullTime:
      format: date-time
      title: NullTime implements sql.NullTime functionality.
      type: string
    pagination:
      properties:
        page:
          default: 1
          description: Pagination Page
          format: int64
          minimum: 1
          type: integer
        per_page:
          default: 250
          description: |-
            Items per Page

            This is the number of items per page.
          format: int64
          maximum: 1000
          minimum: 1
          type: integer
      type: object
    revokedSessions:
      example:
        count: 0
      properties:
        count:
          description: The number of sessions that were revoked.
          format: int64
          type: integer
      type: object
    selfServiceBrowserLocationChangeRequiredError:
      properties:
        code:
          description: The status code
          example: 404
          format: int64
          type: integer
        debug:
          description: |-
            Debug information

            This field is often not exposed to protect against leaking
            sensitive information.
          example: SQL field "foo" is not a bool.
          type: string
        details:
          additionalProperties: true
          description: Further error details
          type: object
        id:
          description: |-
            The error ID

            Useful when trying to identify various errors in application logic.
          type: string
        message:
          description: |-
            Error message

            The error's message.
          example: The resource could not be found
          type: string
        reason:
          description: A human-readable reason for the error
          example: User with ID 1234 does not exist.
          type: string
        redirect_browser_to:
          description: Since when the flow has expired
          type: string
        request:
          description: |-
            The request ID

            The request ID is often exposed internally in order to trace
            errors across service architectures. This is often a UUID.
          example: d7ef54b1-ec15-46e6-bccb-524b82c035e6
          type: string
        status:
          description: The status description
          example: Not Found
          type: string
      required:
      - message
      title: Is sent when a flow requires a browser to change its location.
      type: object
    selfServiceError:
      example:
        updated_at: 2000-01-23T04:56:07.000+00:00
        created_at: 2000-01-23T04:56:07.000+00:00
        id: id
        error: '{}'
      properties:
        created_at:
          description: CreatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        error:
          type: object
        id:
          format: uuid4
          type: string
        updated_at:
          description: UpdatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
      required:
      - id
      type: object
    selfServiceFlowExpiredError:
      description: Is sent when a flow is expired
      properties:
        code:
          description: The status code
          example: 404
          format: int64
          type: integer
        debug:
          description: |-
            Debug information

            This field is often not exposed to protect against leaking
            sensitive information.
          example: SQL field "foo" is not a bool.
          type: string
        details:
          additionalProperties: true
          description: Further error details
          type: object
        id:
          description: |-
            The error ID

            Useful when trying to identify various errors in application logic.
          type: string
        message:
          description: |-
            Error message

            The error's message.
          example: The resource could not be found
          type: string
        reason:
          description: A human-readable reason for the error
          example: User with ID 1234 does not exist.
          type: string
        request:
          description: |-
            The request ID

            The request ID is often exposed internally in order to trace
            errors across service architectures. This is often a UUID.
          example: d7ef54b1-ec15-46e6-bccb-524b82c035e6
          type: string
        since:
          description: |-
            A Duration represents the elapsed time between two instants
            as an int64 nanosecond count. The representation limits the
            largest representable duration to approximately 290 years.
          format: int64
          type: integer
        status:
          description: The status description
          example: Not Found
          type: string
        use_flow_id:
          format: uuid4
          type: string
      required:
      - message
      type: object
    selfServiceFlowType:
      description: The flow type can either be `api` or `browser`.
      title: Type is the flow type.
      type: string
    selfServiceLoginFlow:
      description: |-
        This object represents a login flow. A login flow is initiated at the "Initiate Login API / Browser Flow"
        endpoint by a client.

        Once a login flow is completed successfully, a session cookie or session token will be issued.
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        ui:
          nodes:
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          method: method
          action: action
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
        updated_at: 2000-01-23T04:56:07.000+00:00
        created_at: 2000-01-23T04:56:07.000+00:00
        refresh: true
        return_to: return_to
        id: id
        type: type
        issued_at: 2000-01-23T04:56:07.000+00:00
        request_url: request_url
      properties:
        active:
          $ref: '#/components/schemas/identityCredentialsType'
        created_at:
          description: CreatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
        expires_at:
          description: |-
            ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in,
            a new flow has to be initiated.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        issued_at:
          description: IssuedAt is the time (UTC) when the flow started.
          format: date-time
          type: string
        refresh:
          description: Refresh stores whether this login flow should enforce re-authentication.
          type: boolean
        request_url:
          description: |-
            RequestURL is the initial URL that was requested from Ory Kratos. It can be used
            to forward information contained in the URL's path or query for example.
          type: string
        requested_aal:
          $ref: '#/components/schemas/authenticatorAssuranceLevel'
        return_to:
          description: ReturnTo contains the requested return_to URL.
          type: string
        type:
          description: The flow type can either be `api` or `browser`.
          title: Type is the flow type.
          type: string
        ui:
          $ref: '#/components/schemas/uiContainer'
        updated_at:
          description: UpdatedAt is a helper struct field for gobuffalo.pop.
          format: date-time
          type: string
      required:
      - expires_at
      - id
      - issued_at
      - request_url
      - type
      - ui
      title: Login Flow
      type: object
    selfServiceLogoutUrl:
      example:
        logout_url: logout_url
        logout_token: logout_token
      properties:
        logout_token:
          description: LogoutToken can be used to perform logout using AJAX.
          type: string
        logout_url:
          description: |-
            LogoutURL can be opened in a browser to sign the user out.

            format: uri
          type: string
      required:
      - logout_token
      - logout_url
      type: object
    selfServiceRecoveryFlow:
      description: |-
        This request is used when an identity wants to recover their account.

        We recommend reading the [Account Recovery Documentation](../self-service/flows/password-reset-account-recovery)
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        ui:
          nodes:
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          method: method
          action: action
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
        active: active
        return_to: return_to
        id: id
        type: type
        issued_at: 2000-01-23T04:56:07.000+00:00
        request_url: request_url
      properties:
        active:
          description: |-
            Active, if set, contains the registration method that is being used. It is initially
            not set.
          type: string
        expires_at:
          description: |-
            ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting,
            a new request has to be initiated.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        issued_at:
          description: IssuedAt is the time (UTC) when the request occurred.
          format: date-time
          type: string
        request_url:
          description: |-
            RequestURL is the initial URL that was requested from Ory Kratos. It can be used
            to forward information contained in the URL's path or query for example.
          type: string
        return_to:
          description: ReturnTo contains the requested return_to URL.
          type: string
        state:
          $ref: '#/components/schemas/selfServiceRecoveryFlowState'
        type:
          description: The flow type can either be `api` or `browser`.
          title: Type is the flow type.
          type: string
        ui:
          $ref: '#/components/schemas/uiContainer'
      required:
      - expires_at
      - id
      - issued_at
      - request_url
      - state
      - ui
      title: A Recovery Flow
      type: object
    selfServiceRecoveryFlowState:
      description: |-
        The state represents the state of the recovery flow.

        choose_method: ask the user to choose a method (e.g. recover account via email)
        sent_email: the email has been sent to the user
        passed_challenge: the request was successful and the recovery challenge was passed.
      enum:
      - choose_method
      - sent_email
      - passed_challenge
      title: Recovery Flow State
      type: string
    selfServiceRecoveryLink:
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        recovery_link: recovery_link
      properties:
        expires_at:
          description: |-
            Recovery Link Expires At

            The timestamp when the recovery link expires.
          format: date-time
          type: string
        recovery_link:
          description: |-
            Recovery Link

            This link can be used to recover the account.
          type: string
      required:
      - recovery_link
      type: object
    selfServiceRegistrationFlow:
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        ui:
          nodes:
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          method: method
          action: action
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
        return_to: return_to
        id: id
        type: type
        issued_at: 2000-01-23T04:56:07.000+00:00
        request_url: request_url
      properties:
        active:
          $ref: '#/components/schemas/identityCredentialsType'
        expires_at:
          description: |-
            ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in,
            a new flow has to be initiated.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        issued_at:
          description: IssuedAt is the time (UTC) when the flow occurred.
          format: date-time
          type: string
        request_url:
          description: |-
            RequestURL is the initial URL that was requested from Ory Kratos. It can be used
            to forward information contained in the URL's path or query for example.
          type: string
        return_to:
          description: ReturnTo contains the requested return_to URL.
          type: string
        type:
          description: The flow type can either be `api` or `browser`.
          title: Type is the flow type.
          type: string
        ui:
          $ref: '#/components/schemas/uiContainer'
      required:
      - expires_at
      - id
      - issued_at
      - request_url
      - ui
      type: object
    selfServiceSettingsFlow:
      description: |-
        This flow is used when an identity wants to update settings
        (e.g. profile data, passwords, ...) in a selfservice manner.

        We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        ui:
          nodes:
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          method: method
          action: action
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
        identity:
          recovery_addresses:
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          traits: ""
          updated_at: 2000-01-23T04:56:07.000+00:00
          credentials:
            key:
              updated_at: 2000-01-23T04:56:07.000+00:00
              identifiers:
              - identifiers
              - identifiers
              created_at: 2000-01-23T04:56:07.000+00:00
              config: '{}'
              version: 0
          verifiable_addresses:
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          schema_id: schema_id
          state_changed_at: 2000-01-23T04:56:07.000+00:00
          created_at: 2000-01-23T04:56:07.000+00:00
          schema_url: schema_url
          id: id
        active: active
        return_to: return_to
        id: id
        type: type
        issued_at: 2000-01-23T04:56:07.000+00:00
        request_url: request_url
      properties:
        active:
          description: |-
            Active, if set, contains the registration method that is being used. It is initially
            not set.
          type: string
        expires_at:
          description: |-
            ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting,
            a new flow has to be initiated.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        identity:
          $ref: '#/components/schemas/identity'
        issued_at:
          description: IssuedAt is the time (UTC) when the flow occurred.
          format: date-time
          type: string
        request_url:
          description: |-
            RequestURL is the initial URL that was requested from Ory Kratos. It can be used
            to forward information contained in the URL's path or query for example.
          type: string
        return_to:
          description: ReturnTo contains the requested return_to URL.
          type: string
        state:
          $ref: '#/components/schemas/selfServiceSettingsFlowState'
        type:
          description: The flow type can either be `api` or `browser`.
          title: Type is the flow type.
          type: string
        ui:
          $ref: '#/components/schemas/uiContainer'
      required:
      - expires_at
      - id
      - identity
      - issued_at
      - request_url
      - state
      - ui
      title: Flow represents a Settings Flow
      type: object
    selfServiceSettingsFlowState:
      description: |-
        show_form: No user data has been collected, or it is invalid, and thus the form should be shown.
        success: Indicates that the settings flow has been updated successfully with the provided data.
        Done will stay true when repeatedly checking. If set to true, done will revert back to false only
        when a flow with invalid (e.g. "please use a valid phone number") data was sent.
      enum:
      - show_form
      - success
      title: 'State represents the state of this flow. It knows two states:'
      type: string
    selfServiceVerificationFlow:
      description: |-
        Used to verify an out-of-band communication
        channel such as an email address or a phone number.

        For more information head over to: https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        ui:
          nodes:
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          - meta:
              label:
                context: '{}'
                id: 0
                text: text
                type: type
            messages:
            - context: '{}'
              id: 0
              text: text
              type: type
            - context: '{}'
              id: 0
              text: text
              type: type
            type: type
            group: group
          method: method
          action: action
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
        active: active
        return_to: return_to
        id: id
        type: type
        issued_at: 2000-01-23T04:56:07.000+00:00
        request_url: request_url
      properties:
        active:
          description: |-
            Active, if set, contains the registration method that is being used. It is initially
            not set.
          type: string
        expires_at:
          description: |-
            ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address,
            a new request has to be initiated.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        issued_at:
          description: IssuedAt is the time (UTC) when the request occurred.
          format: date-time
          type: string
        request_url:
          description: |-
            RequestURL is the initial URL that was requested from Ory Kratos. It can be used
            to forward information contained in the URL's path or query for example.
          type: string
        return_to:
          description: ReturnTo contains the requested return_to URL.
          type: string
        state:
          $ref: '#/components/schemas/selfServiceVerificationFlowState'
        type:
          description: The flow type can either be `api` or `browser`.
          title: Type is the flow type.
          type: string
        ui:
          $ref: '#/components/schemas/uiContainer'
      required:
      - id
      - state
      - type
      - ui
      title: A Verification Flow
      type: object
    selfServiceVerificationFlowState:
      description: |-
        The state represents the state of the verification flow.

        choose_method: ask the user to choose a method (e.g. recover account via email)
        sent_email: the email has been sent to the user
        passed_challenge: the request was successful and the recovery challenge was passed.
      enum:
      - choose_method
      - sent_email
      - passed_challenge
      title: Verification Flow State
      type: string
    session:
      description: A Session
      example:
        expires_at: 2000-01-23T04:56:07.000+00:00
        authentication_methods:
        - completed_at: 2000-01-23T04:56:07.000+00:00
          method: link_recovery
        - completed_at: 2000-01-23T04:56:07.000+00:00
          method: link_recovery
        identity:
          recovery_addresses:
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          traits: ""
          updated_at: 2000-01-23T04:56:07.000+00:00
          credentials:
            key:
              updated_at: 2000-01-23T04:56:07.000+00:00
              identifiers:
              - identifiers
              - identifiers
              created_at: 2000-01-23T04:56:07.000+00:00
              config: '{}'
              version: 0
          verifiable_addresses:
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          schema_id: schema_id
          state_changed_at: 2000-01-23T04:56:07.000+00:00
          created_at: 2000-01-23T04:56:07.000+00:00
          schema_url: schema_url
          id: id
        authenticated_at: 2000-01-23T04:56:07.000+00:00
        active: true
        id: id
        issued_at: 2000-01-23T04:56:07.000+00:00
      properties:
        active:
          description: Active state. If false the session is no longer active.
          type: boolean
        authenticated_at:
          description: |-
            The Session Authentication Timestamp

            When this session was authenticated at. If multi-factor authentication was used this
            is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).
          format: date-time
          type: string
        authentication_methods:
          description: A list of authenticators which were used to authenticate the
            session.
          items:
            $ref: '#/components/schemas/sessionAuthenticationMethod'
          title: List of (Used) AuthenticationMethods
          type: array
        authenticator_assurance_level:
          $ref: '#/components/schemas/authenticatorAssuranceLevel'
        expires_at:
          description: |-
            The Session Expiry

            When this session expires at.
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        identity:
          $ref: '#/components/schemas/identity'
        issued_at:
          description: |-
            The Session Issuance Timestamp

            When this session was issued at. Usually equal or close to `authenticated_at`.
          format: date-time
          type: string
      required:
      - id
      - identity
      type: object
    sessionAuthenticationMethod:
      description: A singular authenticator used during authentication / login.
      example:
        completed_at: 2000-01-23T04:56:07.000+00:00
        method: link_recovery
      properties:
        aal:
          $ref: '#/components/schemas/authenticatorAssuranceLevel'
        completed_at:
          description: When the authentication challenge was completed.
          format: date-time
          type: string
        method:
          enum:
          - link_recovery
          - password
          - totp
          - oidc
          - webauthn
          - lookup_secret
          title: The method used
          type: string
      title: AuthenticationMethod identifies an authentication method
      type: object
    sessionAuthenticationMethods:
      description: A list of authenticators which were used to authenticate the session.
      items:
        $ref: '#/components/schemas/sessionAuthenticationMethod'
      title: List of (Used) AuthenticationMethods
      type: array
    sessionDevice:
      properties:
        user_agent:
          description: UserAgent of this device
          type: string
      type: object
    sessionList:
      items:
        $ref: '#/components/schemas/session'
      type: array
    settingsProfileFormConfig:
      properties:
        action:
          description: Action should be used as the form action URL `<form action="{{
            .Action }}" method="post">`.
          type: string
        messages:
          items:
            $ref: '#/components/schemas/uiText'
          type: array
        method:
          description: Method is the form method (e.g. POST)
          type: string
        nodes:
          items:
            $ref: '#/components/schemas/uiNode'
          type: array
      required:
      - action
      - method
      - nodes
      type: object
    submitSelfServiceFlowWithWebAuthnRegistrationMethod:
      properties:
        webauthn_register:
          description: |-
            Register a WebAuthn Security Key

            It is expected that the JSON returned by the WebAuthn registration process
            is included here.
          type: string
        webauthn_register_displayname:
          description: |-
            Name of the WebAuthn Security Key to be Added

            A human-readable name for the security key which will be added.
          type: string
      type: object
    submitSelfServiceLoginFlowBody:
      discriminator:
        mapping:
          lookup_secret: '#/components/schemas/submitSelfServiceLoginFlowWithLookupSecretMethodBody'
          oidc: '#/components/schemas/submitSelfServiceLoginFlowWithOidcMethodBody'
          password: '#/components/schemas/submitSelfServiceLoginFlowWithPasswordMethodBody'
          totp: '#/components/schemas/submitSelfServiceLoginFlowWithTotpMethodBody'
          webauthn: '#/components/schemas/submitSelfServiceLoginFlowWithWebAuthnMethodBody'
        propertyName: method
      oneOf:
      - $ref: '#/components/schemas/submitSelfServiceLoginFlowWithPasswordMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceLoginFlowWithOidcMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceLoginFlowWithTotpMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceLoginFlowWithWebAuthnMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceLoginFlowWithLookupSecretMethodBody'
    submitSelfServiceLoginFlowWithLookupSecretMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        lookup_secret:
          description: The lookup secret.
          type: string
        method:
          description: Method should be set to "lookup_secret" when logging in using
            the lookup_secret strategy.
          type: string
      required:
      - lookup_secret
      - method
      title: submitSelfServiceLoginFlowWithLookupSecretMethodBody is used to decode
        the login form payload.
      type: object
    submitSelfServiceLoginFlowWithOidcMethodBody:
      description: |-
        SubmitSelfServiceLoginFlowWithOidcMethodBody is used to decode the login form payload
        when using the oidc method.
      properties:
        csrf_token:
          description: The CSRF Token
          type: string
        method:
          description: |-
            Method to use

            This field must be set to `oidc` when using the oidc method.
          type: string
        provider:
          description: The provider to register with
          type: string
        traits:
          description: The identity traits. This is a placeholder for the registration
            flow.
          type: object
      required:
      - method
      - provider
      type: object
    submitSelfServiceLoginFlowWithPasswordMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        identifier:
          description: Identifier is the email or username of the user trying to log
            in.
          type: string
        method:
          description: Method should be set to "password" when logging in using the
            identifier and password strategy.
          type: string
        password:
          description: The user's password.
          type: string
        password_identifier:
          description: |-
            Identifier is the email or username of the user trying to log in.
            This field is deprecated!
          type: string
      required:
      - identifier
      - method
      - password
      - password_identifier
      title: submitSelfServiceLoginFlowWithPasswordMethodBody is used to decode the
        login form payload.
      type: object
    submitSelfServiceLoginFlowWithTotpMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        method:
          description: Method should be set to "totp" when logging in using the TOTP
            strategy.
          type: string
        totp_code:
          description: The TOTP code.
          type: string
      required:
      - method
      - totp_code
      title: submitSelfServiceLoginFlowWithTotpMethodBody is used to decode the login
        form payload.
      type: object
    submitSelfServiceLoginFlowWithWebAuthnMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        identifier:
          description: |-
            Identifier is the email or username of the user trying to log in. This field is
            only required when using WebAuthn for passwordless login. When using WebAuthn
            for multi-factor authentication, it is not needed.
          type: string
        method:
          description: Method should be set to "webAuthn" when logging in using the
            WebAuthn strategy.
          type: string
        webauthn_login:
          description: |-
            Login a WebAuthn Security Key

            This must contain the ID of the WebAuthN connection.
          type: string
      required:
      - method
      title: submitSelfServiceLoginFlowWithWebAuthnMethodBody is used to decode the
        login form payload.
      type: object
    submitSelfServiceLogoutFlowWithoutBrowserBody:
      description: nolint:deadcode,unused
      properties:
        session_token:
          description: |-
            The Session Token

            Invalidate this session token.
          type: string
      required:
      - session_token
      type: object
    submitSelfServiceRecoveryFlowBody:
      discriminator:
        mapping:
          link: '#/components/schemas/submitSelfServiceRecoveryFlowWithLinkMethodBody'
        propertyName: method
      oneOf:
      - $ref: '#/components/schemas/submitSelfServiceRecoveryFlowWithLinkMethodBody'
    submitSelfServiceRecoveryFlowWithLinkMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        email:
          description: |-
            Email to Recover

            Needs to be set when initiating the flow. If the email is a registered
            recovery email, a recovery link will be sent. If the email is not known,
            a email with details on what happened will be sent instead.

            format: email
          type: string
        method:
          description: Method supports `link` only right now.
          type: string
      required:
      - email
      - method
      type: object
    submitSelfServiceRegistrationFlowBody:
      discriminator:
        mapping:
          oidc: '#/components/schemas/submitSelfServiceRegistrationFlowWithOidcMethodBody'
          password: '#/components/schemas/submitSelfServiceRegistrationFlowWithPasswordMethodBody'
          webauthn: '#/components/schemas/submitSelfServiceRegistrationFlowWithWebAuthnMethodBody'
        propertyName: method
      oneOf:
      - $ref: '#/components/schemas/submitSelfServiceRegistrationFlowWithPasswordMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceRegistrationFlowWithOidcMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceRegistrationFlowWithWebAuthnMethodBody'
    submitSelfServiceRegistrationFlowWithOidcMethodBody:
      description: |-
        SubmitSelfServiceRegistrationFlowWithOidcMethodBody is used to decode the registration form payload
        when using the oidc method.
      properties:
        csrf_token:
          description: The CSRF Token
          type: string
        method:
          description: |-
            Method to use

            This field must be set to `oidc` when using the oidc method.
          type: string
        provider:
          description: The provider to register with
          type: string
        traits:
          description: The identity traits
          type: object
      required:
      - method
      - provider
      type: object
    submitSelfServiceRegistrationFlowWithPasswordMethodBody:
      description: |-
        SubmitSelfServiceRegistrationFlowWithPasswordMethodBody is used to decode the registration form payload
        when using the password method.
      properties:
        csrf_token:
          description: The CSRF Token
          type: string
        method:
          description: |-
            Method to use

            This field must be set to `password` when using the password method.
          type: string
        password:
          description: Password to sign the user up with
          type: string
        traits:
          description: The identity's traits
          type: object
      required:
      - method
      - password
      - traits
      type: object
    submitSelfServiceRegistrationFlowWithWebAuthnMethodBody:
      properties:
        csrf_token:
          description: CSRFToken is the anti-CSRF token
          type: string
        method:
          description: |-
            Method

            Should be set to "webauthn" when trying to add, update, or remove a webAuthn pairing.
          type: string
        traits:
          description: The identity's traits
          type: object
        webauthn_register:
          description: |-
            Register a WebAuthn Security Key

            It is expected that the JSON returned by the WebAuthn registration process
            is included here.
          type: string
        webauthn_register_displayname:
          description: |-
            Name of the WebAuthn Security Key to be Added

            A human-readable name for the security key which will be added.
          type: string
      required:
      - method
      - traits
      type: object
    submitSelfServiceSettingsFlowBody:
      discriminator:
        mapping:
          lookup_secret: '#/components/schemas/submitSelfServiceSettingsFlowWithLookupMethodBody'
          oidc: '#/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody'
          password: '#/components/schemas/submitSelfServiceSettingsFlowWithPasswordMethodBody'
          profile: '#/components/schemas/submitSelfServiceSettingsFlowWithProfileMethodBody'
          totp: '#/components/schemas/submitSelfServiceSettingsFlowWithTotpMethodBody'
          webauthn: '#/components/schemas/submitSelfServiceSettingsFlowWithWebAuthnMethodBody'
        propertyName: method
      oneOf:
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithPasswordMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithProfileMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithTotpMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithWebAuthnMethodBody'
      - $ref: '#/components/schemas/submitSelfServiceSettingsFlowWithLookupMethodBody'
    submitSelfServiceSettingsFlowWithLookupMethodBody:
      properties:
        csrf_token:
          description: CSRFToken is the anti-CSRF token
          type: string
        lookup_secret_confirm:
          description: If set to true will save the regenerated lookup secrets
          type: boolean
        lookup_secret_disable:
          description: Disables this method if true.
          type: boolean
        lookup_secret_regenerate:
          description: If set to true will regenerate the lookup secrets
          type: boolean
        lookup_secret_reveal:
          description: If set to true will reveal the lookup secrets
          type: boolean
        method:
          description: |-
            Method

            Should be set to "lookup" when trying to add, update, or remove a lookup pairing.
          type: string
      required:
      - method
      type: object
    submitSelfServiceSettingsFlowWithOidcMethodBody:
      description: nolint:deadcode,unused
      properties:
        flow:
          description: |-
            Flow ID is the flow's ID.

            in: query
          type: string
        link:
          description: |-
            Link this provider

            Either this or `unlink` must be set.

            type: string
            in: body
          type: string
        method:
          description: |-
            Method

            Should be set to profile when trying to update a profile.
          type: string
        traits:
          description: |-
            The identity's traits

            in: body
          type: object
        unlink:
          description: |-
            Unlink this provider

            Either this or `link` must be set.

            type: string
            in: body
          type: string
      required:
      - method
      type: object
    submitSelfServiceSettingsFlowWithPasswordMethodBody:
      properties:
        csrf_token:
          description: CSRFToken is the anti-CSRF token
          type: string
        method:
          description: |-
            Method

            Should be set to password when trying to update a password.
          type: string
        password:
          description: Password is the updated password
          type: string
      required:
      - method
      - password
      type: object
    submitSelfServiceSettingsFlowWithProfileMethodBody:
      description: nolint:deadcode,unused
      properties:
        csrf_token:
          description: |-
            The Anti-CSRF Token

            This token is only required when performing browser flows.
          type: string
        method:
          description: |-
            Method

            Should be set to profile when trying to update a profile.
          type: string
        traits:
          description: Traits contains all of the identity's traits.
          type: object
      required:
      - method
      - traits
      type: object
    submitSelfServiceSettingsFlowWithTotpMethodBody:
      properties:
        csrf_token:
          description: CSRFToken is the anti-CSRF token
          type: string
        method:
          description: |-
            Method

            Should be set to "totp" when trying to add, update, or remove a totp pairing.
          type: string
        totp_code:
          description: ValidationTOTP must contain a valid TOTP based on the
          type: string
        totp_unlink:
          description: |-
            UnlinkTOTP if true will remove the TOTP pairing,
            effectively removing the credential. This can be used
            to set up a new TOTP device.
          type: boolean
      required:
      - method
      type: object
    submitSelfServiceSettingsFlowWithWebAuthnMethodBody:
      properties:
        csrf_token:
          description: CSRFToken is the anti-CSRF token
          type: string
        method:
          description: |-
            Method

            Should be set to "webauthn" when trying to add, update, or remove a webAuthn pairing.
          type: string
        webauthn_register:
          description: |-
            Register a WebAuthn Security Key

            It is expected that the JSON returned by the WebAuthn registration process
            is included here.
          type: string
        webauthn_register_displayname:
          description: |-
            Name of the WebAuthn Security Key to be Added

            A human-readable name for the security key which will be added.
          type: string
        webauthn_remove:
          description: |-
            Remove a WebAuthn Security Key

            This must contain the ID of the WebAuthN connection.
          type: string
      required:
      - method
      type: object
    submitSelfServiceVerificationFlowBody:
      description: nolint:deadcode,unused
      discriminator:
        mapping:
          link: '#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody'
        propertyName: method
      oneOf:
      - $ref: '#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody'
    submitSelfServiceVerificationFlowWithLinkMethodBody:
      properties:
        csrf_token:
          description: Sending the anti-csrf token is only required for browser login
            flows.
          type: string
        email:
          description: |-
            Email to Verify

            Needs to be set when initiating the flow. If the email is a registered
            verification email, a verification link will be sent. If the email is not known,
            a email with details on what happened will be sent instead.

            format: email
          type: string
        method:
          description: Method supports `link` only right now.
          type: string
      required:
      - email
      - method
      type: object
    successfulSelfServiceLoginWithoutBrowser:
      description: The Response for Login Flows via API
      example:
        session_token: session_token
        session:
          expires_at: 2000-01-23T04:56:07.000+00:00
          authentication_methods:
          - completed_at: 2000-01-23T04:56:07.000+00:00
            method: link_recovery
          - completed_at: 2000-01-23T04:56:07.000+00:00
            method: link_recovery
          identity:
            recovery_addresses:
            - updated_at: 2000-01-23T04:56:07.000+00:00
              created_at: 2000-01-23T04:56:07.000+00:00
              id: id
              value: value
              via: via
            - updated_at: 2000-01-23T04:56:07.000+00:00
              created_at: 2000-01-23T04:56:07.000+00:00
              id: id
              value: value
              via: via
            traits: ""
            updated_at: 2000-01-23T04:56:07.000+00:00
            credentials:
              key:
                updated_at: 2000-01-23T04:56:07.000+00:00
                identifiers:
                - identifiers
                - identifiers
                created_at: 2000-01-23T04:56:07.000+00:00
                config: '{}'
                version: 0
            verifiable_addresses:
            - updated_at: 2014-01-01T23:28:56.782Z
              verified_at: 2000-01-23T04:56:07.000+00:00
              verified: true
              created_at: 2014-01-01T23:28:56.782Z
              id: id
              value: value
              status: status
              via: via
            - updated_at: 2014-01-01T23:28:56.782Z
              verified_at: 2000-01-23T04:56:07.000+00:00
              verified: true
              created_at: 2014-01-01T23:28:56.782Z
              id: id
              value: value
              status: status
              via: via
            schema_id: schema_id
            state_changed_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            schema_url: schema_url
            id: id
          authenticated_at: 2000-01-23T04:56:07.000+00:00
          active: true
          id: id
          issued_at: 2000-01-23T04:56:07.000+00:00
      properties:
        session:
          $ref: '#/components/schemas/session'
        session_token:
          description: |-
            The Session Token

            A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization
            Header:

            Authorization: bearer ${session-token}

            The session token is only issued for API flows, not for Browser flows!
          type: string
      required:
      - session
      type: object
    successfulSelfServiceRegistrationWithoutBrowser:
      description: The Response for Registration Flows via API
      example:
        session_token: session_token
        identity:
          recovery_addresses:
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          - updated_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            id: id
            value: value
            via: via
          traits: ""
          updated_at: 2000-01-23T04:56:07.000+00:00
          credentials:
            key:
              updated_at: 2000-01-23T04:56:07.000+00:00
              identifiers:
              - identifiers
              - identifiers
              created_at: 2000-01-23T04:56:07.000+00:00
              config: '{}'
              version: 0
          verifiable_addresses:
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          - updated_at: 2014-01-01T23:28:56.782Z
            verified_at: 2000-01-23T04:56:07.000+00:00
            verified: true
            created_at: 2014-01-01T23:28:56.782Z
            id: id
            value: value
            status: status
            via: via
          schema_id: schema_id
          state_changed_at: 2000-01-23T04:56:07.000+00:00
          created_at: 2000-01-23T04:56:07.000+00:00
          schema_url: schema_url
          id: id
        session:
          expires_at: 2000-01-23T04:56:07.000+00:00
          authentication_methods:
          - completed_at: 2000-01-23T04:56:07.000+00:00
            method: link_recovery
          - completed_at: 2000-01-23T04:56:07.000+00:00
            method: link_recovery
          identity:
            recovery_addresses:
            - updated_at: 2000-01-23T04:56:07.000+00:00
              created_at: 2000-01-23T04:56:07.000+00:00
              id: id
              value: value
              via: via
            - updated_at: 2000-01-23T04:56:07.000+00:00
              created_at: 2000-01-23T04:56:07.000+00:00
              id: id
              value: value
              via: via
            traits: ""
            updated_at: 2000-01-23T04:56:07.000+00:00
            credentials:
              key:
                updated_at: 2000-01-23T04:56:07.000+00:00
                identifiers:
                - identifiers
                - identifiers
                created_at: 2000-01-23T04:56:07.000+00:00
                config: '{}'
                version: 0
            verifiable_addresses:
            - updated_at: 2014-01-01T23:28:56.782Z
              verified_at: 2000-01-23T04:56:07.000+00:00
              verified: true
              created_at: 2014-01-01T23:28:56.782Z
              id: id
              value: value
              status: status
              via: via
            - updated_at: 2014-01-01T23:28:56.782Z
              verified_at: 2000-01-23T04:56:07.000+00:00
              verified: true
              created_at: 2014-01-01T23:28:56.782Z
              id: id
              value: value
              status: status
              via: via
            schema_id: schema_id
            state_changed_at: 2000-01-23T04:56:07.000+00:00
            created_at: 2000-01-23T04:56:07.000+00:00
            schema_url: schema_url
            id: id
          authenticated_at: 2000-01-23T04:56:07.000+00:00
          active: true
          id: id
          issued_at: 2000-01-23T04:56:07.000+00:00
      properties:
        identity:
          $ref: '#/components/schemas/identity'
        session:
          $ref: '#/components/schemas/session'
        session_token:
          description: |-
            The Session Token

            This field is only set when the session hook is configured as a post-registration hook.

            A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization
            Header:

            Authorization: bearer ${session-token}

            The session token is only issued for API flows, not for Browser flows!
          type: string
      required:
      - identity
      type: object
    uiContainer:
      description: Container represents a HTML Form. The container can work with both
        HTTP Form and JSON requests
      example:
        nodes:
        - meta:
            label:
              context: '{}'
              id: 0
              text: text
              type: type
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
          type: type
          group: group
        - meta:
            label:
              context: '{}'
              id: 0
              text: text
              type: type
          messages:
          - context: '{}'
            id: 0
            text: text
            type: type
          - context: '{}'
            id: 0
            text: text
            type: type
          type: type
          group: group
        method: method
        action: action
        messages:
        - context: '{}'
          id: 0
          text: text
          type: type
        - context: '{}'
          id: 0
          text: text
          type: type
      properties:
        action:
          description: Action should be used as the form action URL `<form action="{{
            .Action }}" method="post">`.
          type: string
        messages:
          items:
            $ref: '#/components/schemas/uiText'
          type: array
        method:
          description: Method is the form method (e.g. POST)
          type: string
        nodes:
          items:
            $ref: '#/components/schemas/uiNode'
          type: array
      required:
      - action
      - method
      - nodes
      type: object
    uiNode:
      description: |-
        Nodes are represented as HTML elements or their native UI equivalents. For example,
        a node can be an `<img>` tag, or an `<input element>` but also `some plain text`.
      example:
        meta:
          label:
            context: '{}'
            id: 0
            text: text
            type: type
        messages:
        - context: '{}'
          id: 0
          text: text
          type: type
        - context: '{}'
          id: 0
          text: text
          type: type
        type: type
        group: group
      properties:
        attributes:
          $ref: '#/components/schemas/uiNodeAttributes'
        group:
          type: string
        messages:
          items:
            $ref: '#/components/schemas/uiText'
          type: array
        meta:
          $ref: '#/components/schemas/uiNodeMeta'
        type:
          type: string
      required:
      - attributes
      - group
      - messages
      - meta
      - type
      title: Node represents a flow's nodes
      type: object
    uiNodeAnchorAttributes:
      properties:
        href:
          description: |-
            The link's href (destination) URL.

            format: uri
          type: string
        id:
          description: A unique identifier
          type: string
        node_type:
          type: string
        title:
          $ref: '#/components/schemas/uiText'
      required:
      - href
      - id
      - node_type
      - title
      title: AnchorAttributes represents the attributes of an anchor node.
      type: object
    uiNodeAttributes:
      discriminator:
        mapping:
          anchor: '#/components/schemas/uiNodeAnchorAttributes'
          image: '#/components/schemas/uiNodeImageAttributes'
          input: '#/components/schemas/uiNodeInputAttributes'
          script: '#/components/schemas/uiNodeScriptAttributes'
          text: '#/components/schemas/uiNodeTextAttributes'
        propertyName: node_type
      oneOf:
      - $ref: '#/components/schemas/uiNodeInputAttributes'
      - $ref: '#/components/schemas/uiNodeTextAttributes'
      - $ref: '#/components/schemas/uiNodeImageAttributes'
      - $ref: '#/components/schemas/uiNodeAnchorAttributes'
      - $ref: '#/components/schemas/uiNodeScriptAttributes'
      title: Attributes represents a list of attributes (e.g. `href="foo"` for links).
    uiNodeGroup:
      type: string
    uiNodeImageAttributes:
      properties:
        height:
          description: Height of the image
          format: int64
          type: integer
        id:
          description: A unique identifier
          type: string
        node_type:
          type: string
        src:
          description: |-
            The image's source URL.

            format: uri
          type: string
        width:
          description: Width of the image
          format: int64
          type: integer
      required:
      - height
      - id
      - node_type
      - src
      - width
      title: ImageAttributes represents the attributes of an image node.
      type: object
    uiNodeInputAttributeType:
      type: string
    uiNodeInputAttributes:
      description: InputAttributes represents the attributes of an input node
      properties:
        disabled:
          description: Sets the input's disabled field to true or false.
          type: boolean
        label:
          $ref: '#/components/schemas/uiText'
        name:
          description: The input's element name.
          type: string
        node_type:
          type: string
        onclick:
          description: |-
            OnClick may contain javascript which should be executed on click. This is primarily
            used for WebAuthn.
          type: string
        pattern:
          description: The input's pattern.
          type: string
        required:
          description: Mark this input field as required.
          type: boolean
        type:
          type: string
        value:
          description: The input's value.
          nullable: true
      required:
      - disabled
      - name
      - node_type
      - type
      type: object
    uiNodeMeta:
      description: |-
        This might include a label and other information that can optionally
        be used to render UIs.
      example:
        label:
          context: '{}'
          id: 0
          text: text
          type: type
      properties:
        label:
          $ref: '#/components/schemas/uiText'
      title: A Node's Meta Information
      type: object
    uiNodeScriptAttributes:
      properties:
        async:
          description: The script async type
          type: boolean
        crossorigin:
          description: The script cross origin policy
          type: string
        id:
          description: A unique identifier
          type: string
        integrity:
          description: The script's integrity hash
          type: string
        node_type:
          type: string
        nonce:
          description: |-
            Nonce for CSP

            A nonce you may want to use to improve your Content Security Policy.
            You do not have to use this value but if you want to improve your CSP
            policies you may use it. You can also choose to use your own nonce value!
          type: string
        referrerpolicy:
          description: The script referrer policy
          type: string
        src:
          description: The script source
          type: string
        type:
          description: The script MIME type
          type: string
      required:
      - async
      - crossorigin
      - id
      - integrity
      - node_type
      - nonce
      - referrerpolicy
      - src
      - type
      title: ScriptAttributes represent script nodes which load javascript.
      type: object
    uiNodeTextAttributes:
      properties:
        id:
          description: A unique identifier
          type: string
        node_type:
          type: string
        text:
          $ref: '#/components/schemas/uiText'
      required:
      - id
      - node_type
      - text
      title: TextAttributes represents the attributes of a text node.
      type: object
    uiNodeType:
      type: string
    uiNodes:
      items:
        $ref: '#/components/schemas/uiNode'
      type: array
    uiText:
      example:
        context: '{}'
        id: 0
        text: text
        type: type
      properties:
        context:
          description: The message's context. Useful when customizing messages.
          type: object
        id:
          format: int64
          type: integer
        text:
          description: The message text. Written in american english.
          type: string
        type:
          type: string
      required:
      - id
      - text
      - type
      type: object
    uiTextType:
      type: string
    uiTexts:
      items:
        $ref: '#/components/schemas/uiText'
      type: array
    verifiableIdentityAddress:
      description: VerifiableAddress is an identity's verifiable address
      example:
        updated_at: 2014-01-01T23:28:56.782Z
        verified_at: 2000-01-23T04:56:07.000+00:00
        verified: true
        created_at: 2014-01-01T23:28:56.782Z
        id: id
        value: value
        status: status
        via: via
      properties:
        created_at:
          description: When this entry was created
          example: 2014-01-01T23:28:56.782Z
          format: date-time
          type: string
        id:
          format: uuid4
          type: string
        status:
          description: VerifiableAddressStatus must not exceed 16 characters as that
            is the limitation in the SQL Schema
          type: string
        updated_at:
          description: When this entry was last updated
          example: 2014-01-01T23:28:56.782Z
          format: date-time
          type: string
        value:
          description: |-
            The address value

            example foo@user.com
          type: string
        verified:
          description: Indicates if the address has already been verified
          example: true
          type: boolean
        verified_at:
          format: date-time
          title: NullTime implements sql.NullTime functionality.
          type: string
        via:
          description: VerifiableAddressType must not exceed 16 characters as that
            is the limitation in the SQL Schema
          type: string
      required:
      - id
      - status
      - value
      - verified
      - via
      type: object
    version:
      properties:
        version:
          description: Version is the service's version.
          type: string
      type: object
    webAuthnJavaScript:
      type: string
    inline_response_200:
      example:
        status: status
      properties:
        status:
          description: Always "ok".
          type: string
      required:
      - status
      type: object
    inline_response_503:
      properties:
        errors:
          additionalProperties:
            type: string
          description: Errors contains a list of errors that caused the not ready
            status.
          type: object
      required:
      - errors
      type: object
    inline_response_200_1:
      example:
        version: version
      properties:
        version:
          description: The version of Ory Kratos.
          type: string
      required:
      - version
      type: object
  securitySchemes:
    oryAccessToken:
      in: header
      name: Authorization
      type: apiKey
x-forwarded-proto: string
x-request-id: string