Hey, is it possible to trigger the email confirmation flow after creating an identity through the admin API? The identity object is showing a verifiable address as expected, with

"status":"pending"

. Can I actually send the confirmation email at this point?

hey, check this out: https://www.ory.sh/docs/kratos/manage-identities/invite-users

Got it, thanks! A related question - can I update the schema of the identity model after it's been created? I imagine for my flow I would need to use a schema with only the email, but for confirmed users I'd like to have the other fields required.

I’m sorry for barging in, but I’d like to share link to an “invite flow” feature request for the context – https://github.com/ory/kratos/issues/2525 I don’t have high hopes for this to be implemented, but, IMO, a great benefit of having this on Ory/Kratos side is that Kratos will be sending all the identity related emails, be it an invite, a verification, or a recovery code.

Excellent! I was hoping to delegate all the emailing to Ory, but, as you said, it doesn't look like that'll be implemented soon. The ability to update identity schema is very useful, though!

FWIW you can already implement a passwordless invite/login flow by hijacking the recovery flow. (To create the account, use createIdentitiy API request from admin API) Its a bit tricky & hacky to get it to work without breaking the recovery email template, but otherwise works. I wanted to do a writeup for it, but I think we are also working on implementing it properly @handsome-agency-20541

That’s awesome news @magnificent-energy-493, thanks for the heads up! I do remember playing with the recovery flow. AFAIR I was able to trigger it, but it worked only to send recovery links (which have their own problems), not codes – a user has no place to input those. By the way, since we’re touching this subject. I have recently seen an email from verification flow that had a recovery code and a link with that recovery code pre-filled. A user still has to click the “Submit” button, and it’s great because it solves the one-time link problem. I wonder, if it is possible to have the same code-link for recovery emails?

That's a good idea, thanks! I'm more concerned with how to force the user to fill in the missing data after they complete the recovery flow.

Using validation webhooks, perhaps.

Let me check if I got this right - the only way I see to "bend" the recovery flow to my liking is to: 1. Create an identity through the Ory admin API 2. Create a recovery flow for that identity via the Ory frontend API 3. Here's the hacky bit - I'd have to emulate the user entering their email into the recovery flow and hitting "Submit", honestly not sure how to do that from the server side 4. After that, the email would be sent to the user and I'm basically in the clear So the big question is step 3, and I'm not sure how to approach it or if this whole thing is a good idea in the first place...

3. Here’s the hacky bit - I’d have to emulate the user entering their email into the recovery flow and hitting “Submit”, honestly not sure how to do that from the server side

Through

POST https://{project}.<http://projects.oryapis.com/self-service/recovery|projects.oryapis.com/self-service/recovery>

, I think. https://www.ory.sh/docs/reference/api#tag/frontend/operation/updateRecoveryFlow @magnificent-energy-493 please correct me if I’m wrong.

Huh, that seems cleaner than I thought. I expected to need to emulate a browser request, with cookies and all. Let me give it a try

There are two modes of the flows: browser and native (aka API). Browser is safer because it involves CSRF cookies, but in our “hacky” case it can’t be used, because we can’t send those cookies to the browser. So only an native mode remains viable.

It works! I'll need to patch the email templates, as you said, but the basic functionality is there! Thank you so much!

Happy to help! Beware of magic links though, corporate services like outlook safe links tend to eat them up occasionally.

https://ory-community.slack.com/archives/C02MR4DEEGH/p1683116247235559?thread_ts=1683048122.537769&cid=C02MR4DEEGH That is completely right, thanks Maksim 🙌 And you are right, it would be nicer with code, as outlook etc. sometimes open them and invalidate 😕 I am not 100% sure if you can implement it with the code strategy - but you should be able to with a custom UI. In any case we should have the “proper” feature soon™️

Hey, I just wondered if there was any update on this feature? It would be super useful to be able to send a registration confirmation after creating an identity via the admin api. Thanks!