Hello everyone! I'm planning to create an array field called "roles" metadata that includes the "role" and "organizationID" attributes. However, I would like these fields to be read-only for regular users. They should only be updated by the "/admin/identity" endpoint, but can be accessed through the "/whoami" endpoint.I need help. Here is my schema:

{
  "$id": "<https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json>",
  "$schema": "<http://json-schema.org/draft-07/schema#>",
  "title": "Person",
  "type": "object",
  "properties": {
    "traits": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string",
          "format": "email",
          "title": "E-Mail",
          "minLength": 3,
          "<http://ory.sh/kratos|ory.sh/kratos>": {
            "credentials": {
              "password": {
                "identifier": true
              }
            },
            "verification": {
              "via": "email"
            },
            "recovery": {
              "via": "email"
            }
          }
        },
        "name": {
          "type": "string",
          "title": "Name"
        },
        "firstVisit": {
          "type": "boolean",
          "title": "firstVisit"
        },
        "roles": {
          "type": "array",
          "readOnly": true,
          "accessControl": {
            "write": [
              "kratos_admin"
            ]
          },
          "items": {
            "type": "object",
            "properties": {
              "organizationId": {
                "type": "string"
              },
              "role": {
                "type": "string"
              }
            },
            "additionalProperties": true
          }
        }
      },
      "required": [
        "email"
      ],
      "additionalProperties": true
    }
  }
}

You need to create a new object under "properties" (same level as "traits") that you name "metadata_public" and move the properties into that object.

Thanks @blue-caravan-99316 I got it working. Now I would like to call another service when a user is registered using webhook and send identity id

As a start, check out https://www.ory.sh/docs/guides/integrate-with-ory-cloud-through-webhooks Be aware that currently

metadata_admin

properties aren't sent. I have a todo here to push a PR that mentions it in the docs.

Thanks @blue-caravan-99316.Maybe you did not undestand my question well.I want to add a Webhook which post identityId and email to a my service to create an org with it. I have something like this but it throwing an error

registration:
      lifespan: 10m
      ui_url: <http://127.0.0.1:4455/registration>
      after:
        password:
          hooks:
            - hook: session
            - hook: show_verification_ui
            - hook: web_hook
              config: 
                url: <http://localhost:8080/post>
                method: POST
                body: "{{ 'function(ctx) {  payload: std.manifestJsonEx({ email: ctx.identity.verifiable_addresses[0].value, email_prop: \\'{email}\\' }, \\' \\'), payload_encoding: \\'string\\' }' | b64enc }}"

I understood it, and referred you to the documentation which is what I followed to accomplish the same thing.

Am following that but when the hook triger it does not send anything in the body

Just follow the documentation. You've defined it in a way I'm not familiar with so I can't help. From the docs;

hook: web_hook # To use webhooks, you must set 'hook' to 'web_hook'
config:
  url: <https://test.hook.site.sh/before_login_hook> # Webhook URL.
  method: POST # HTTP method used to send request to the webhook URL.
  body: <base64://ENCODED_JSONNET> # Encoded Jsonnet template used to render payload.

Am following the doc but I always got this when the hook is called :

{
  "id": "35027eeb-44fe-400d-a468-df89f4a09ca0",
  "error": {
    "code": 500,
    "status": "Internal Server Error",
    "message": "POST <http://localhost:8080/post> giving up after 3 attempt(s): Post \"<http://localhost:8080/post>\": dial tcp 127.0.0.1:8080: connect: connection refused"
  },
  "created_at": "2023-05-17T12:45:51.357753Z",
  "updated_at": "2023-05-17T12:45:51.357753Z"
}