ZitadelDocs

Get current step (re-render)

Returns the current capability step without advancing the state machine. Useful for page reloads or re-rendering after a network error.

GET
/flow/{id}

Returns the current capability step without advancing the state machine. Useful for page reloads or re-rendering after a network error.

Path Parameters

id*string

Flow ID returned by POST /flow or the latest POST /flow/{id}/submit. Used to look up the correct flow state from the encrypted cookie, which can hold multiple concurrent flows. May change between responses when a flow pivot or pop occurs — always use the id from the latest response.

_zflow*string

Encrypted flow state cookie set by POST /flow or the previous POST /flow/{id}/submit. The cookie holds the sealed state of one flow; the {id} path parameter must name that flow, any other id is refused.

Browsers send this automatically; non-browser clients must capture the Set-Cookie header and resend it.

Response Body

Current step. Only a render that resolved a parked SSO identity sets the flow cookie; any other render leaves it unchanged. When that render completed the sign-in, the step is terminal, the cookie is cleared, and the step carries the handoff token.

application/json
  1. response
id*string

Flow handle. Use this as the path parameter for subsequent submit/event calls. May change between responses when a flow pivot or pop occurs.

session_id*string

Underlying session ID. Stable across all stacked flows.

session_token?string

Reserved for future rotation. The sealed _zflow cookie carries the flow state today.

step*

A step contains ordered capability arrays: what to collect (fields), what the user can do (actions), and what security gates must be satisfied (gates). The LiquidJS template in branding.liquid_template iterates these arrays in order and builds name-keyed indexes locally for lookup.

branding?

Resolved branding inherited from the app → team → project hierarchy. Determined at flow creation based on audience context. Does not change between steps.

redirect_uri?string

Present when step.complete is redirect.

Formaturi
handoff_token?string

Short-lived, audience-bound token produced on flow completion. Exchange it for a session via POST /sessions/exchange. Only present when step.complete is set.

handoff_token_expires_at?string

Expiry timestamp for handoff_token. Only present when handoff_token is set.

Formatdate-time
curl -X GET 'https://example.com/flow/string' \  --cookie '_zflow=string'
{  "id": "string",  "session_id": "string",  "session_token": "string",  "step": {    "name": "string",    "texts": {      "title_key": "string",      "description_key": "string"    },    "error": "string",    "complete": "redirect",    "redirect_url": "http://example.com",    "fields": [],    "identifier": {      "value": "string",      "autocomplete": "string"    },    "actions": [],    "gates": {},    "sso_providers": [],    "challenge": {      "method": "passkey",      "challenge_id": "string",      "options": {}    }  },  "branding": {    "$schema": "string",    "layout": "centered",    "liquid_template": "string",    "logo_url": "http://example.com",    "hero_url": "http://example.com",    "theme": {      "mode": "light",      "light": {        "logo_url": "http://example.com",        "palette": {          "primary": "#4F46E5",          "on_primary": "#4F46E5",          "background": "#4F46E5",          "surface": "#4F46E5",          "muted": "#4F46E5",          "border": "#4F46E5",          "text": "#4F46E5",          "text_muted": "#4F46E5",          "link": "#4F46E5",          "success": "#4F46E5",          "warning": "#4F46E5",          "error": "#4F46E5"        }      },      "dark": {        "logo_url": "http://example.com",        "palette": {          "primary": "#4F46E5",          "on_primary": "#4F46E5",          "background": "#4F46E5",          "surface": "#4F46E5",          "muted": "#4F46E5",          "border": "#4F46E5",          "text": "#4F46E5",          "text_muted": "#4F46E5",          "link": "#4F46E5",          "success": "#4F46E5",          "warning": "#4F46E5",          "error": "#4F46E5"        }      }    },    "typography": {      "font_family": "string",      "font_url": "http://example.com",      "scale": 0.75    },    "shape": {      "radius": "none",      "density": "compact",      "logo_scale": 0.5    }  },  "redirect_uri": "http://example.com",  "handoff_token": "string",  "handoff_token_expires_at": "2019-08-24T14:15:22Z"}