openapi: 3.0.3
info:
contact:
email: hi@ory.sh
description: 'Documentation for all of Ory Hydra''s APIs.
'
license:
name: Apache 2.0
title: Ory Hydra api identity API
version: ''
tags:
- description: APIs for managing identities.
name: identity
paths:
/admin/identities:
get:
description: 'Lists all [identities](https://www.ory.com/docs/kratos/concepts/identity-user-model) in the system. Note: filters cannot be combined.'
operationId: listIdentities
parameters:
- description: 'Deprecated Items per Page
DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future.
This is the number of items per page.'
in: query
name: per_page
schema:
default: 250
format: int64
maximum: 1000
minimum: 1
type: integer
- description: 'Deprecated Pagination Page
DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future.
This value is currently an integer, but it is not sequential. The value is not the page number, but a
reference. The next page can be any number and some numbers might return an empty list.
For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist.
The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the
`Link` header.'
in: query
name: page
schema:
format: int64
type: integer
- description: 'Page Size
This is the number of items per page to return. For details on pagination please head over to the
[pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_size
schema:
default: 250
format: int64
maximum: 500
minimum: 1
type: integer
- description: 'Next Page Token
The next page token. For details on pagination please head over to the
[pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_token
schema:
type: string
- description: "Read Consistency Level (preview)\n\nThe read consistency level determines the consistency guarantee for reads:\n\nstrong (slow): The read is guaranteed to return the most recent data committed at the start of the read.\neventual (very fast): The result will return data that is about 4.8 seconds old.\n\nThe default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with\n`ory patch project --replace '/previews/default_read_consistency_level=\"strong\"'`.\n\nSetting the default consistency level to `eventual` may cause regressions in the future as we add consistency\ncontrols to more APIs. Currently, the following APIs will be affected by this setting:\n\n`GET /admin/identities`\n\nThis feature is in preview and only available in Ory Network.\n ConsistencyLevelUnset ConsistencyLevelUnset is the unset / default consistency level.\nstrong ConsistencyLevelStrong ConsistencyLevelStrong is the strong consistency level.\neventual ConsistencyLevelEventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps."
in: query
name: consistency
schema:
enum:
- ''
- strong
- eventual
type: string
x-go-enum-desc: ' ConsistencyLevelUnset ConsistencyLevelUnset is the unset / default consistency level.
strong ConsistencyLevelStrong ConsistencyLevelStrong is the strong consistency level.
eventual ConsistencyLevelEventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.'
- description: 'Retrieve multiple identities by their IDs.
This parameter has the following limitations:
Duplicate or non-existent IDs are ignored.
The order of returned IDs may be different from the request.
This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).'
in: query
name: ids
schema:
items:
type: string
type: array
- description: 'CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match.
Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.'
in: query
name: credentials_identifier
schema:
type: string
- description: 'This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior.
THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH.
CredentialsIdentifierSimilar is the (partial) identifier (username, email) of the credentials to look up using similarity search.
Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.'
in: query
name: preview_credentials_identifier_similar
schema:
type: string
- description: 'Include Credentials in Response
Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return
the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token, and the OpenID Connect ID Token if available.'
in: query
name: include_credential
schema:
items:
type: string
type: array
- description: List identities that belong to a specific organization.
in: query
name: organization_id
schema:
type: string
responses:
'200':
$ref: '#/components/responses/listIdentities'
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: List Identities
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-medium
patch:
description: 'Creates multiple [identities](https://www.ory.com/docs/kratos/concepts/identity-user-model).
You can also use this endpoint to [import credentials](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities),
including passwords, social sign-in settings, and multi-factor authentication methods.
If the patch includes hashed passwords you can import up to 1,000 identities per request.
If the patch includes at least one plaintext password you can import up to 200 identities per request.
Avoid importing large batches with plaintext passwords. They can cause timeouts as the passwords need to be hashed before they are stored.
If at least one identity is imported successfully, the response status is 200 OK.
If all imports fail, the response is one of the following 4xx errors:
400 Bad Request: The request payload is invalid or improperly formatted.
409 Conflict: Duplicate identities or conflicting data were detected.
If you get a 504 Gateway Timeout:
Reduce the batch size
Avoid duplicate identities
Pre-hash passwords with BCrypt
If the issue persists, contact support.'
operationId: batchPatchIdentities
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/patchIdentitiesBody'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/batchPatchIdentitiesResponse'
description: batchPatchIdentitiesResponse
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Create multiple identities
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
post:
description: 'Create an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model). This endpoint can also be used to
[import credentials](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities)
for instance passwords, social sign in configurations, or multifactor methods.'
operationId: createIdentity
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/createIdentityBody'
x-originalParamName: Body
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/identity'
description: identity
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Create an Identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
/admin/identities/by/external/{externalID}:
get:
description: 'Return an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) by its external ID. You can optionally
include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.'
operationId: getIdentityByExternalID
parameters:
- description: ExternalID must be set to the ID of identity you want to get
in: path
name: externalID
required: true
schema:
type: string
- description: 'Include Credentials in Response
Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return
the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token, and the OpenID Connect ID Token if available.'
in: query
name: include_credential
schema:
items:
enum:
- password
- oidc
- totp
- lookup_secret
- webauthn
- code
- passkey
- profile
- saml
- deviceauthn
- link_recovery
- code_recovery
type: string
type: array
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/identity'
description: identity
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Get an Identity by its External ID
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-medium
/admin/identities/{id}:
delete:
description: 'Calling this endpoint irrecoverably and permanently deletes the [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) given its ID. This action can not be undone.
This endpoint returns 204 when the identity was deleted or 404 if the identity was not found.'
operationId: deleteIdentity
parameters:
- description: ID is the identity's ID.
in: path
name: id
required: true
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Delete an Identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
get:
description: 'Return an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) by its ID. You can optionally
include credentials (e.g. social sign in connections) in the response by using the `include_credential` query parameter.'
operationId: getIdentity
parameters:
- description: ID must be set to the ID of identity you want to get
in: path
name: id
required: true
schema:
type: string
- description: 'Include Credentials in Response
Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return
the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token, and the OpenID Connect ID Token if available.'
in: query
name: include_credential
schema:
items:
enum:
- password
- oidc
- totp
- lookup_secret
- webauthn
- code
- passkey
- profile
- saml
- deviceauthn
- link_recovery
- code_recovery
type: string
type: array
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/identity'
description: identity
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Get an Identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-high
patch:
description: 'Partially updates an [identity''s](https://www.ory.com/docs/kratos/concepts/identity-user-model) field using [JSON Patch](https://jsonpatch.com/).
The fields `id`, `stateChangedAt` and `credentials` can not be updated using this method.'
operationId: patchIdentity
parameters:
- description: ID must be set to the ID of identity you want to update
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/jsonPatchDocument'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/identity'
description: identity
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Patch an Identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
put:
description: 'This endpoint updates an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model). The full identity
payload (except credentials) is expected.
It is possible to update the identity''s credentials as well. Using this operation, credentials will not be overwritten
but instead added to the list. For example, if a user has a social sign in connection set up, updating the credentials
will keep the social sign in connection and add the new credentials to the list. This prevents accidentally overwriting
credentials and locking out users. A complete view of all credential types is here:
`password`: The existing password credential will be completely replaced with the new configuration. You can provide either a hashed password, a plaintext password (which will be hashed), or enable the password migration hook.
`oidc`, `saml`: The existing OIDC and SAML credentials will be kept and the new credentials will be added to the list.
`totp`: The existing TOTP credentials will be replaced with the new configuration.
`lookup_secret`: The existing Lookup Secret codes will be kept and the new codes will be added to the list.
`webauthn`, `passkey`: The existing credentials are preserved, new credentials are added, and credentials with matching IDs are updated with new values. If a new `user_handle` is provided, it''s added to the identity''s identifiers list while preserving previous user handles.
`code`: To import code credentials, configure your identity schema to use one of the identity traits as an identifier source (`{"ory.sh/kratos":{"code":{"identifier":true", "via":"email"}}}`).'
operationId: updateIdentity
parameters:
- description: ID must be set to the ID of identity you want to update
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/updateIdentityBody'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/identity'
description: identity
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Update an Identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
/admin/identities/{id}/credentials/{type}:
delete:
description: 'Delete an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) credential by its type.
You cannot delete passkeys or code auth credentials through this API.'
operationId: deleteIdentityCredentials
parameters:
- description: ID is the identity's ID.
in: path
name: id
required: true
schema:
type: string
- description: 'Type is the type of credentials to delete.
password CredentialsTypePassword
oidc CredentialsTypeOIDC
totp CredentialsTypeTOTP
lookup_secret CredentialsTypeLookup
webauthn CredentialsTypeWebAuthn
code CredentialsTypeCodeAuth
passkey CredentialsTypePasskey
profile CredentialsTypeProfile
saml CredentialsTypeSAML
deviceauthn CredentialsTypeDeviceAuthn
link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself.
code_recovery CredentialsTypeRecoveryCode'
in: path
name: type
required: true
schema:
enum:
- password
- oidc
- totp
- lookup_secret
- webauthn
- code
- passkey
- profile
- saml
- deviceauthn
- link_recovery
- code_recovery
type: string
x-go-enum-desc: 'password CredentialsTypePassword
oidc CredentialsTypeOIDC
totp CredentialsTypeTOTP
lookup_secret CredentialsTypeLookup
webauthn CredentialsTypeWebAuthn
code CredentialsTypeCodeAuth
passkey CredentialsTypePasskey
profile CredentialsTypeProfile
saml CredentialsTypeSAML
deviceauthn CredentialsTypeDeviceAuthn
link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself.
code_recovery CredentialsTypeRecoveryCode'
- description: 'Identifier is the identifier of the OIDC/SAML credential to delete.
Find the identifier by calling the `GET /admin/identities/{id}?include_credential={oidc,saml}` endpoint.'
in: query
name: identifier
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Delete a credential for a specific identity
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
/admin/identities/{id}/sessions:
delete:
description: Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.
operationId: deleteIdentitySessions
parameters:
- description: ID is the identity's ID.
in: path
name: id
required: true
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Delete & Invalidate an Identity's Sessions
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
get:
description: This endpoint returns all sessions that belong to the given Identity.
operationId: listIdentitySessions
parameters:
- description: 'Deprecated Items per Page
DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future.
This is the number of items per page.'
in: query
name: per_page
schema:
default: 250
format: int64
maximum: 1000
minimum: 1
type: integer
- description: 'Deprecated Pagination Page
DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future.
This value is currently an integer, but it is not sequential. The value is not the page number, but a
reference. The next page can be any number and some numbers might return an empty list.
For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist.
The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the
`Link` header.'
in: query
name: page
schema:
format: int64
type: integer
- description: 'Page Size
This is the number of items per page to return. For details on pagination please head over to the
[pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_size
schema:
default: 250
format: int64
maximum: 500
minimum: 1
type: integer
- description: 'Next Page Token
The next page token. For details on pagination please head over to the
[pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_token
schema:
type: string
- description: ID is the identity's ID.
in: path
name: id
required: true
schema:
type: string
- description: Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.
in: query
name: active
schema:
type: boolean
responses:
'200':
$ref: '#/components/responses/listIdentitySessions'
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: List an Identity's Sessions
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-medium
/admin/recovery/code:
post:
description: 'This endpoint creates a recovery code which should be given to the user in order for them to recover
(or activate) their account.'
operationId: createRecoveryCodeForIdentity
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/createRecoveryCodeForIdentityBody'
x-originalParamName: Body
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/recoveryCodeForIdentity'
description: recoveryCodeForIdentity
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Create a Recovery Code
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
/admin/recovery/link:
post:
description: 'This endpoint creates a recovery link which should be given to the user in order for them to recover
(or activate) their account.'
operationId: createRecoveryLinkForIdentity
parameters:
- in: query
name: return_to
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/createRecoveryLinkForIdentityBody'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/recoveryLinkForIdentity'
description: recoveryLinkForIdentity
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryAccessToken: []
summary: Create a Recovery Link
tags:
- identity
x-ory-ratelimit-bucket: kratos-admin-low
/admin/sessions:
get:
description: Listing all sessions that exist.
operationId: listSessions
parameters:
- description: 'Items per Page
This is the number of items per page to return.
For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_size
schema:
default: 250
format: int64
maximum: 1000
minimum: 1
type: integer
- description: 'Next Page Token
The next page token.
For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).'
in: query
name: page_token
schema:
type: string
- description: Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.
in: query
name: active
schema:
type: boolean
- description: 'ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session.
If no value is provided, the expandable properties are skipped.'
in: query
name: expand
schema:
items:
enum:
- identity
- devices
type: string
type: array
responses:
'200':
$ref: '#/components/responses/listSessions'
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorGeneric'
description: errorGeneric
security:
- oryA
# --- truncated at 32 KB (79 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/ory/refs/heads/main/openapi/ory-identity-api-openapi.yml