To update a user's username or email in Ory Kratos using AJAX, you need to work with the Settings Flow. This flow allows users to update their profile information, including identifiers like username and email. ## Using the Settings Flow with AJAX 1. Initialize the Settings Flow: First, you need to initialize a settings flow by making a request to the API endpoint:

javascript    // For API clients    fetch('<https://your-ory-project.projects.oryapis.com/self-service/settings/api>', {      headers: {        'Accept': 'application/json',        'Authorization': 'bearer ' + sessionToken      }    })    .then(response => response.json())    .then(flow => {      // Store the flow ID and action URL for the next step      const actionUrl = flow.ui.action;      // Continue with the update    });

2. Submit the Updated Information: Once you have the flow, you can submit the updated profile information:

javascript    fetch(actionUrl, {      method: 'POST',      headers: {        'Accept': 'application/json',        'Content-Type': 'application/json',        'Authorization': 'bearer ' + sessionToken      },      body: JSON.stringify({        // For updating traits like username or email        "method": "profile",        "traits": {          "email": "<mailto:new-email@example.com|new-email@example.com>",          "username": "new-username"        }      })    })    .then(response => response.json())    .then(result => {      // Handle the response      if (result.state === "success") {        console.log("Profile updated successfully");      }    });

Note that updating email or username is considered a privileged operation, so if the user's session is older than the configured

privileged_session_max_age

, they will need to re-authenticate before making these changes [Settings and profile updates](https://www.ory.sh/docs/kratos/self-service/flows/user-settings). ## Response Handling When the update is successful, Ory Kratos will respond with a JSON payload that includes the updated identity information:

javascript {   "id": "flow-id",   "type": "api",   // Other flow information   "ui": {     "action": "action-url",     "method": "POST",     "nodes": [       // UI nodes     ],     "messages": [       {         "id": 1050001,         "text": "Your changes have been saved!",         "type": "info"       }     ]   },   "identity": {     "id": "identity-id",     "schema_id": "default",     "traits": {       "email": "<mailto:new-email@example.com|new-email@example.com>",       "username": "new-username"     },     // Other identity information   },   "state": "success" }

The identity schema must be configured to allow these fields to be used as identifiers. You can customize your identity schema to define which fields can be used as identifiers for different authentication methods [Customize identity schemas](https://www.ory.sh/docs/kratos/manage-identities/customize-identity-schema#examples). Remember that for API clients, if the session is too old for privileged operations, you'll receive a 403 Forbidden status, requiring you to request a new session using the Login Flow.