Repository: ory/kratos
Pull request #1024 (2021-01-31 04:03:30)

fix: Courier message dequeuing race condition
## Related issue

<!--
Please link the GitHub issue this pull request resolves in the format of `#1234`. If you discussed this change
with a maintainer, please mention her/him using the `@` syntax (e.g. `@aeneasr`).

If this change neither resolves an existing issue nor has sign-off from one of the maintainers, there is a
chance substantial changes will be requested or that the changes will be rejected.

You can discuss changes with maintainers either in the Github Discusssions in this repository or
join the [ORY Chat](https://www.ory.sh/chat).
-->
~~#402~~ #652, #732 
## Proposed changes

<!--
Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request.
-->
Fixes the courier message dequeuing race condition by modifying `*sql.Persister.NextMessages(ctx context.Context, limit uint8)` to retrieve only messages with status `MessageStatusQueued` and update the status of the retrieved messages to `MessageStatusProcessing` within a transaction. On message send failure, the message's status is reset to `MessageStatusQueued`, so that the message can be dequeued in a subsequent `NextMessages` call. On message send success, the status is updated to `MessageStatusSent` (no change there).

## Checklist

<!--
Put an `x` in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of
them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.
-->

- [x] I have read the [contributing guidelines](../blob/master/CONTRIBUTING.md).
- [x] I have read the [security policy](../security/policy).
- [x] I confirm that this pull request does not address a security
      vulnerability. If this pull request addresses a security. vulnerability, I
      confirm that I got green light (please contact
      [security@ory.sh](mailto:security@ory.sh)) from the maintainers to push
      the changes.
- [x] I have added tests that prove my fix is effective or that my feature
      works.
- [ ] I have added or changed [the documentation](docs/docs).

## Further comments

<!--
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
you did and what alternatives you considered, etc...
-->
I updated the existing message pulling test to demonstrate that messages won't be dequeued twice.

*Caveat*: This does necessitate the DB having an isolation level equivalent to [repeatable reads](https://en.wikipedia.org/wiki/Isolation_(database_systems)#Repeatable_reads) or better. MySQL's default isolation level is repeatable read, CockroachDB's is serializable, so these two will be free from race conditions by default. PostgreSQL's default isolation level is read committed, so it would still be susceptible to this race condition if the isolation level were not updated. sqlx supports setting per-transaction isolation levels natively, ~~but pop doesn't expose this functionality.~~ pop *does* support per-transaction isolation levels as pointed out by @zepatrik, so no need to enforce some DB-level config. 

CLAassistant: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/ory/kratos?pullRequest=1024) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/ory/kratos?pullRequest=1024) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/ory/kratos?pullRequest=1024) it.</sub>
zepatrik: This will still keep failing messages (e.g. unresolvable email address) indefinitely, right?
mattbonnell: > This will still keep failing messages (e.g. unresolvable email address) indefinitely, right?

Yeah, this just addresses the multiple sending issue. I admit that saying it fixes #402 is a bit misleading based on the title of that issue, but @aeneasr marked all tickets pertaining to the multiple sending issue as as dupes of #402, I think because the conversation of this issue was most thoroughly examined there, so I referenced that one here.

To fix the issue of perpetually retrying unresolvable email domains, we could validate whether the domain is valid before attempting to send. I could include that fix in this PR if desired, but maybe it would be best to resolve it in a follow-up PR.
mattbonnell: Hey @aeneasr, I'm failing some of these end-to-end tests with timeout errors such as the following 
```
waiting for 1 resources: http-get://127.0.0.1:4457/
wait-on(6578) Timed out waiting for: http-get://127.0.0.1:4457/; exiting with error
Error: Timed out waiting for: http-get://127.0.0.1:4457/
    at MergeMapSubscriber.project (/go/src/github.com/ory/kratos/node_modules/wait-on/lib/wait-on.js:130:25)
    at MergeMapSubscriber._tryNext (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/operators/mergeMap.js:69:27)
    at MergeMapSubscriber._next (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/operators/mergeMap.js:59:18)
    at MergeMapSubscriber.Subscriber.next (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/Subscriber.js:66:18)
    at AsyncAction.dispatch [as work] (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/observable/timer.js:31:16)
    at AsyncAction._execute (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/scheduler/AsyncAction.js:71:18)
    at AsyncAction.execute (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/scheduler/AsyncAction.js:59:26)
    at AsyncScheduler.flush (/go/src/github.com/ory/kratos/node_modules/rxjs/internal/scheduler/AsyncScheduler.js:52:32)
    at listOnTimeout (internal/timers.js:549:17)
    at processTimers (internal/timers.js:492:7)
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! @ wait-on: `wait-on "-l" "-t" "30000" "http-get://127.0.0.1:4434/health/ready" "http-get://127.0.0.1:4455/health" "http-get://127.0.0.1:4445/health/ready" "http-get://127.0.0.1:4446/" "http-get://127.0.0.1:4456/health" "http-get://127.0.0.1:4457/" "http-get://127.0.0.1:4437/mail"`
npm ERR! Exit status 1
npm ERR! 
npm ERR! Failed at the @ wait-on script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/circleci/.npm/_logs/2021-01-31T17_07_48_756Z-debug.log


Exited with code exit status 1
```
Is this something transient or could it somehow be related to my PR?
aeneasr: Thank you, this already looks great! However, I fear this won't solve the issue. Looking at the code, there is a transaction which queries and updates the message row. Unfortunately this can't prevent two nodes sending the same email because this does not prevent a second reader to read at the same time as another reader. The transaction does not lock the table - there are several transaction isolation levels available but I am not sure if we should put a hard lock here, as the mail queue could be frequented quite often.

What I suggest doing instead is to have a worker node which is a singleton instance (e.g. runs as a background job) that processes the mail queue. That way, we don't have concurrency issues. To make things a bit easier, we could add a flag `--single-node` to the `kratos serve` command which would tell the process that it is ok to run background nodes because it's just a single node.

What do you think?

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index f898498f6..2ef3feb96 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -21,4 +21,4 @@ run:
     - sdk/
   skip-files:
     - ".+_test.go"
-    - "internal/faker.go"
+    - "corpx/faker.go"
diff --git a/.schema/api.swagger.json b/.schema/api.swagger.json
index 721cfc5ce..6e667aa86 100755
--- a/.schema/api.swagger.json
+++ b/.schema/api.swagger.json
@@ -1672,7 +1672,7 @@
   },
   "definitions": {
     "CompleteSelfServiceLoginFlowWithPasswordMethod": {
-      "description": "CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod complete self service login flow with password method",
+      "description": "CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod complete self service login flow with password method",
       "type": "object",
       "properties": {
         "csrf_token": {
@@ -1690,7 +1690,7 @@
       }
     },
     "CompleteSelfServiceSettingsFlowWithPasswordMethod": {
-      "description": "CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod complete self service settings flow with password method",
+      "description": "CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod complete self service settings flow with password method",
       "type": "object",
       "required": [
         "password"
@@ -1707,7 +1707,7 @@
       }
     },
     "CreateIdentity": {
-      "description": "CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity create identity",
+      "description": "CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity create identity",
       "type": "object",
       "required": [
         "schema_id",
@@ -1725,7 +1725,7 @@
       }
     },
     "CreateRecoveryLink": {
-      "description": "CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink create recovery link",
+      "description": "CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink create recovery link",
       "type": "object",
       "required": [
         "identity_id"
@@ -1747,12 +1747,12 @@
       "title": "CredentialsType  represents several different credential types, like password credentials, passwordless credentials,"
     },
     "ID": {
-      "description": "ID ID ID ID ID ID ID ID ID ID ID",
+      "description": "ID ID ID ID ID ID ID ID ID ID ID ID",
       "type": "integer",
       "format": "int64"
     },
     "Identity": {
-      "description": "Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity",
+      "description": "Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity",
       "type": "object",
       "required": [
         "id",
@@ -1794,7 +1794,7 @@
       }
     },
     "Message": {
-      "description": "Message Message Message Message Message Message Message Message Message Message message",
+      "description": "Message Message Message Message Message Message Message Message Message Message Message message",
       "type": "object",
       "properties": {
         "context": {
@@ -1814,7 +1814,7 @@
       }
     },
     "Messages": {
-      "description": "Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages",
+      "description": "Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages",
       "type": "array",
       "items": {
         "$ref": "#/definitions/Message"
@@ -1826,7 +1826,7 @@
       "title": "NullTime implements sql.NullTime functionality."
     },
     "RecoveryAddress": {
-      "description": "RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress recovery address",
+      "description": "RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress recovery address",
       "type": "object",
       "required": [
         "id",
@@ -1846,15 +1846,15 @@
       }
     },
     "RecoveryAddressType": {
-      "description": "RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type",
+      "description": "RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type",
       "type": "string"
     },
     "State": {
-      "description": "State State State State State State State State State State state",
+      "description": "State State State State State State State State State State State state",
       "type": "string"
     },
     "Traits": {
-      "description": "Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits",
+      "description": "Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits",
       "type": "object"
     },
     "Type": {
@@ -1867,7 +1867,7 @@
       "format": "uuid4"
     },
     "UpdateIdentity": {
-      "description": "UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity update identity",
+      "description": "UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity update identity",
       "type": "object",
       "required": [
         "traits"
@@ -1884,7 +1884,7 @@
       }
     },
     "VerifiableAddress": {
-      "description": "VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress verifiable address",
+      "description": "VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress verifiable address",
       "type": "object",
       "required": [
         "id",
@@ -1915,15 +1915,15 @@
       }
     },
     "VerifiableAddressStatus": {
-      "description": "VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status",
+      "description": "VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status",
       "type": "string"
     },
     "VerifiableAddressType": {
-      "description": "VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type",
+      "description": "VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type",
       "type": "string"
     },
     "completeSelfServiceRecoveryFlowWithLinkMethod": {
-      "description": "CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod complete self service recovery flow with link method",
+      "description": "CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod complete self service recovery flow with link method",
       "type": "object",
       "properties": {
         "csrf_token": {
@@ -1937,7 +1937,7 @@
       }
     },
     "completeSelfServiceVerificationFlowWithLinkMethod": {
-      "description": "CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod complete self service verification flow with link method",
+      "description": "CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod complete self service verification flow with link method",
       "type": "object",
       "properties": {
         "csrf_token": {
@@ -2013,7 +2013,7 @@
     "genericError": {
       "description": "Error responses are sent when an error (e.g. unauthorized, bad request, ...) occurred.",
       "type": "object",
-      "title": "GenericError Error response",
+      "title": "Error response",
       "properties": {
         "error": {
           "$ref": "#/definitions/genericErrorPayload"
@@ -2021,7 +2021,7 @@
       }
     },
     "genericErrorPayload": {
-      "description": "GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload",
+      "description": "GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload",
       "type": "object",
       "properties": {
         "code": {
@@ -2059,6 +2059,7 @@
       }
     },
     "healthNotReadyStatus": {
+      "description": "HealthNotReadyStatus health not ready status",
       "type": "object",
       "properties": {
         "errors": {
@@ -2071,6 +2072,7 @@
       }
     },
     "healthStatus": {
+      "description": "HealthStatus HealthStatus health status",
       "type": "object",
       "properties": {
         "status": {
@@ -2131,10 +2133,11 @@
       }
     },
     "loginFlowMethod": {
+      "description": "LoginFlowMethod login flow method",
       "type": "object",
       "required": [
-        "config",
-        "method"
+        "method",
+        "config"
       ],
       "properties": {
         "config": {
@@ -2146,12 +2149,11 @@
       }
     },
     "loginFlowMethodConfig": {
-      "description": "LoginFlowMethodConfig LoginFlowMethodConfig login flow method config",
       "type": "object",
       "required": [
         "action",
-        "method",
-        "fields"
+        "fields",
+        "method"
       ],
       "properties": {
         "action": {
@@ -2178,11 +2180,11 @@
       }
     },
     "loginViaApiResponse": {
-      "description": "LoginViaAPIResponse LoginViaAPIResponse The Response for Login Flows via API",
+      "description": "The Response for Login Flows via API",
       "type": "object",
       "required": [
-        "session_token",
-        "session"
+        "session",
+        "session_token"
       ],
       "properties": {
         "session": {
@@ -2197,13 +2199,13 @@
     "recoveryFlow": {
       "description": "This request is used when an identity wants to recover their account.\n\nWe recommend reading the [Account Recovery Documentation](../self-service/flows/password-reset-account-recovery)",
       "type": "object",
-      "title": "A Recovery Flow",
+      "title": "RecoveryFlow A Recovery Flow",
       "required": [
-        "expires_at",
         "id",
+        "expires_at",
         "issued_at",
-        "methods",
         "request_url",
+        "methods",
         "state"
       ],
       "properties": {
@@ -2247,11 +2249,10 @@
       }
     },
     "recoveryFlowMethod": {
-      "description": "RecoveryFlowMethod recovery flow method",
       "type": "object",
       "required": [
-        "method",
-        "config"
+        "config",
+        "method"
       ],
       "properties": {
         "config": {
@@ -2264,12 +2265,11 @@
       }
     },
     "recoveryFlowMethodConfig": {
-      "description": "RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config",
       "type": "object",
       "required": [
         "action",
-        "method",
-        "fields"
+        "fields",
+        "method"
       ],
       "properties": {
         "action": {
@@ -2289,13 +2289,14 @@
       }
     },
     "recoveryLink": {
+      "description": "RecoveryLink RecoveryLink recovery link",
       "type": "object",
       "required": [
         "recovery_link"
       ],
       "properties": {
         "expires_at": {
-          "description": "Recovery Link Expires At\n\nThe timestamp when the recovery link expires.",
+          "description": "Recovery Link Expires At\n\nThe timestamp when the recovery link expires.\nFormat: date-time\nFormat: date-time",
           "type": "string",
           "format": "date-time"
         },
@@ -2351,11 +2352,10 @@
       }
     },
     "registrationFlowMethod": {
-      "description": "RegistrationFlowMethod registration flow method",
       "type": "object",
       "required": [
-        "method",
-        "config"
+        "config",
+        "method"
       ],
       "properties": {
         "config": {
@@ -2367,11 +2367,12 @@
       }
     },
     "registrationFlowMethodConfig": {
+      "description": "RegistrationFlowMethodConfig RegistrationFlowMethodConfig registration flow method config",
       "type": "object",
       "required": [
         "action",
-        "fields",
-        "method"
+        "method",
+        "fields"
       ],
       "properties": {
         "action": {
@@ -2418,7 +2419,7 @@
       }
     },
     "revokeSession": {
-      "description": "RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession revoke session",
+      "description": "RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession revoke session",
       "type": "object",
       "required": [
         "session_token"
@@ -2431,7 +2432,7 @@
       }
     },
     "session": {
-      "description": "Session Session session",
+      "description": "Session session",
       "type": "object",
       "required": [
         "id",
@@ -2471,7 +2472,7 @@
     "settingsFlow": {
       "description": "This flow is used when an identity wants to update settings\n(e.g. profile data, passwords, ...) in a selfservice manner.\n\nWe recommend reading the [User Settings Documentation](../self-service/flows/user-settings)",
       "type": "object",
-      "title": "SettingsFlow Flow represents a Settings Flow",
+      "title": "SettingsFlow SettingsFlow Flow represents a Settings Flow",
       "required": [
         "id",
         "expires_at",
@@ -2525,10 +2526,11 @@
       }
     },
     "settingsFlowMethod": {
+      "description": "SettingsFlowMethod settings flow method",
       "type": "object",
       "required": [
-        "config",
-        "method"
+        "method",
+        "config"
       ],
       "properties": {
         "config": {
@@ -2541,12 +2543,11 @@
       }
     },
     "settingsFlowMethodConfig": {
-      "description": "SettingsFlowMethodConfig settings flow method config",
       "type": "object",
       "required": [
         "action",
-        "method",
-        "fields"
+        "fields",
+        "method"
       ],
       "properties": {
         "action": {
@@ -2566,7 +2567,7 @@
       }
     },
     "settingsViaApiResponse": {
-      "description": "SettingsViaAPIResponse SettingsViaAPIResponse The Response for Settings Flows via API",
+      "description": "SettingsViaAPIResponse SettingsViaAPIResponse SettingsViaAPIResponse The Response for Settings Flows via API",
       "type": "object",
       "required": [
         "flow",
@@ -2584,7 +2585,7 @@
     "verificationFlow": {
       "description": "Used to verify an out-of-band communication\nchannel such as an email address or a phone number.\n\nFor more information head over to: https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation",
       "type": "object",
-      "title": "VerificationFlow A Verification Flow",
+      "title": "VerificationFlow VerificationFlow A Verification Flow",
       "required": [
         "methods",
         "state"
@@ -2595,7 +2596,7 @@
           "type": "string"
         },
         "expires_at": {
-          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address,\na new request has to be initiated.\nFormat: date-time",
+          "description": "ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address,\na new request has to be initiated.\nFormat: date-time\nFormat: date-time",
           "type": "string",
           "format": "date-time"
         },
@@ -2603,7 +2604,7 @@
           "$ref": "#/definitions/UUID"
         },
         "issued_at": {
-          "description": "IssuedAt is the time (UTC) when the request occurred.\nFormat: date-time",
+          "description": "IssuedAt is the time (UTC) when the request occurred.\nFormat: date-time\nFormat: date-time",
           "type": "string",
           "format": "date-time"
         },
@@ -2647,12 +2648,11 @@
       }
     },
     "verificationFlowMethodConfig": {
-      "description": "VerificationFlowMethodConfig VerificationFlowMethodConfig verification flow method config",
       "type": "object",
       "required": [
         "action",
-        "method",
-        "fields"
+        "fields",
+        "method"
       ],
       "properties": {
         "action": {
@@ -2672,6 +2672,7 @@
       }
     },
     "version": {
+      "description": "Version Version Version Version Version Version version",
       "type": "object",
       "properties": {
         "version": {
diff --git a/.schema/config.schema.json b/.schema/config.schema.json
index 7bc89cd94..bf00860de 100644
--- a/.schema/config.schema.json
+++ b/.schema/config.schema.json
@@ -137,7 +137,7 @@
         },
         "provider": {
           "title": "Provider",
-          "description": "Can be one of github, gitlab, generic, google, microsoft, discord, slack.",
+          "description": "Can be one of github, gitlab, generic, google, microsoft, discord, slack, facebook.",
           "type": "string",
           "enum": [
             "github",
@@ -146,7 +146,8 @@
             "google",
             "microsoft",
             "discord",
-            "slack"
+            "slack",
+            "facebook"
           ],
           "examples": [
             "google"
@@ -974,12 +975,13 @@
       "properties": {
         "default_schema_url": {
           "title": "JSON Schema URL for default identity traits",
-          "description": "Path to the JSON Schema which describes a default identity's traits.",
+          "description": "URL for JSON Schema which describes a default identity's traits. Can be a file path, a https URL, or a base64 encoded string.",
           "type": "string",
           "format": "uri",
           "examples": [
             "file://path/to/identity.traits.schema.json",
-            "https://foo.bar.com/path/to/identity.traits.schema.json"
+            "https://foo.bar.com/path/to/identity.traits.schema.json",
+            "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
           ]
         },
         "schemas": {
@@ -989,7 +991,7 @@
             [
               {
                 "id": "customer",
-                "url": "https://foo.bar.com/path/to/customer.traits.schema.json"
+                "url": "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
               },
               {
                 "id": "employee",
@@ -997,7 +999,7 @@
               },
               {
                 "id": "employee-v2",
-                "url": "https://foo.bar.com/path/to/employee.v2.traits.schema.json"
+                "url": "file://path/to/employee.v2.traits.schema.json"
               }
             ]
           ],
@@ -1013,11 +1015,13 @@
               },
               "url": {
                 "type": "string",
-                "title": "Path to the JSON Schema",
+                "title": "JSON Schema URL for identity traits schema",
+                "description": "URL for JSON Schema which describes a identity's traits. Can be a file path, a https URL, or a base64 encoded string.",
                 "format": "uri",
                 "examples": [
                   "file://path/to/identity.traits.schema.json",
-                  "https://foo.bar.com/path/to/identity.traits.schema.json"
+                  "https://foo.bar.com/path/to/identity.traits.schema.json",
+                  "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
                 ]
               }
             },
diff --git a/continuity/persistence.go b/continuity/persistence.go
index ba99729b9..f0f7c53c4 100644
--- a/continuity/persistence.go
+++ b/continuity/persistence.go
@@ -26,12 +26,10 @@ type Persister interface {
 	DeleteContinuitySession(ctx context.Context, id uuid.UUID) error
 }
 
-func TestPersister(p interface {
+func TestPersister(ctx context.Context, p interface {
 	Persister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
-	ctx := context.Background()
-
 	var createIdentity = func(t *testing.T) *identity.Identity {
 		id := identity.Identity{ID: x.NewUUID()}
 		require.NoError(t, p.CreateIdentity(ctx, &id))
diff --git a/internal/faker.go b/corpx/faker.go
similarity index 98%
rename from internal/faker.go
rename to corpx/faker.go
index 2a2c25aa0..15b421491 100644
--- a/internal/faker.go
+++ b/corpx/faker.go
@@ -1,4 +1,4 @@
-package internal
+package corpx
 
 import (
 	"math/rand"
@@ -22,7 +22,14 @@ import (
 	"github.com/ory/kratos/x"
 )
 
+var setup bool
+
 func RegisterFakes() {
+	if setup {
+		return
+	}
+	setup = true
+
 	_ = faker.SetRandomMapAndSliceSize(4)
 
 	if err := faker.AddProvider("birthdate", func(v reflect.Value) (interface{}, error) {
diff --git a/courier/courier.go b/courier/courier.go
index c8f000749..9c2b1f194 100644
--- a/courier/courier.go
+++ b/courier/courier.go
@@ -146,6 +146,12 @@ func (m *Courier) watchMessages(ctx context.Context, errChan chan error) {
 							// WithField("email_to", msg.Recipient).
 							WithField("message_from", from).
 							Error("Unable to send email using SMTP connection.")
+						if err := m.d.CourierPersister().SetMessageStatus(ctx, msg.ID, MessageStatusQueued); err != nil {
+							m.d.Logger().
+								WithError(err).
+								WithField("message_id", msg.ID).
+								Error(`Unable to reset the failed message's status to "queued".`)
+						}
 						continue
 					}
 
diff --git a/courier/message.go b/courier/message.go
index ccf6443d7..f4a2ac24a 100644
--- a/courier/message.go
+++ b/courier/message.go
@@ -14,6 +14,7 @@ type MessageStatus int
 const (
 	MessageStatusQueued MessageStatus = iota + 1
 	MessageStatusSent
+	MessageStatusProcessing
 )
 
 type MessageType int
diff --git a/courier/persistence.go b/courier/persistence.go
index 7abde265f..3e14f4f7b 100644
--- a/courier/persistence.go
+++ b/courier/persistence.go
@@ -32,8 +32,7 @@ type (
 	}
 )
 
-func TestPersister(p Persister) func(t *testing.T) {
-	ctx := context.Background()
+func TestPersister(ctx context.Context, p Persister) func(t *testing.T) {
 	return func(t *testing.T) {
 		t.Run("case=no messages in queue", func(t *testing.T) {
 			m, err := p.NextMessages(ctx, 10)
@@ -64,6 +63,7 @@ func TestPersister(p Persister) func(t *testing.T) {
 
 		t.Run("case=pull messages from the queue", func(t *testing.T) {
 			for k, expected := range messages {
+				expected.Status = MessageStatusProcessing
 				t.Run(fmt.Sprintf("message=%d", k), func(t *testing.T) {
 					messages, err := p.NextMessages(ctx, 1)
 					require.NoError(t, err)
@@ -76,8 +76,6 @@ func TestPersister(p Persister) func(t *testing.T) {
 					assert.Equal(t, expected.Status, actual.Status)
 					assert.Equal(t, expected.Type, actual.Type)
 					assert.Equal(t, expected.Recipient, actual.Recipient)
-
-					require.NoError(t, p.SetMessageStatus(ctx, actual.ID, MessageStatusSent))
 				})
 			}
 
diff --git a/docs/docs/admin/managing-users-identities.mdx b/docs/docs/admin/managing-users-identities.mdx
index ab29fee12..fe4cf793c 100644
--- a/docs/docs/admin/managing-users-identities.mdx
+++ b/docs/docs/admin/managing-users-identities.mdx
@@ -202,5 +202,5 @@ Identity JSON Schema:
 
 For more detailed information and general guidelines on these flows, take a look
 at the
-[Account Recovery and Password Reset](../self-service/flows/account-recovery.md)
+[Account Recovery and Password Reset](../self-service/flows/account-recovery.mdx)
 section.
diff --git a/docs/docs/cli/kratos-identities-delete.md b/docs/docs/cli/kratos-identities-delete.md
index 9be9d0e68..443ea65cd 100644
--- a/docs/docs/cli/kratos-identities-delete.md
+++ b/docs/docs/cli/kratos-identities-delete.md
@@ -46,7 +46,7 @@ To delete the identity with the recovery email address "foo@bar.com", run:
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities-get.md b/docs/docs/cli/kratos-identities-get.md
index cb1835f1f..5c3a0508a 100644
--- a/docs/docs/cli/kratos-identities-get.md
+++ b/docs/docs/cli/kratos-identities-get.md
@@ -46,7 +46,7 @@ To get the identities with the recovery email address at the domain "ory.sh", ru
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities-import.md b/docs/docs/cli/kratos-identities-import.md
index c63196e7a..593b07cc5 100644
--- a/docs/docs/cli/kratos-identities-import.md
+++ b/docs/docs/cli/kratos-identities-import.md
@@ -54,7 +54,7 @@ $ cat file.json | kratos identities import
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities-list.md b/docs/docs/cli/kratos-identities-list.md
index dc197ddb8..594b020a4 100644
--- a/docs/docs/cli/kratos-identities-list.md
+++ b/docs/docs/cli/kratos-identities-list.md
@@ -32,7 +32,7 @@ kratos identities list [<page> <per-page>] [flags]
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities-patch.md b/docs/docs/cli/kratos-identities-patch.md
index ca7931aef..0a589d4de 100644
--- a/docs/docs/cli/kratos-identities-patch.md
+++ b/docs/docs/cli/kratos-identities-patch.md
@@ -33,7 +33,7 @@ kratos identities patch <file.json [file-2.json [file-3.json] ...]> [flags]
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities-validate.md b/docs/docs/cli/kratos-identities-validate.md
index 3e706c8f4..2f141721e 100644
--- a/docs/docs/cli/kratos-identities-validate.md
+++ b/docs/docs/cli/kratos-identities-validate.md
@@ -35,7 +35,7 @@ kratos identities validate <file.json [file-2.json [file-3.json] ...]> [flags]
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-identities.md b/docs/docs/cli/kratos-identities.md
index adc6fa10d..a3c0af831 100644
--- a/docs/docs/cli/kratos-identities.md
+++ b/docs/docs/cli/kratos-identities.md
@@ -22,7 +22,7 @@ Tools to interact with remote identities
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -h, --help              help for identities
   -q, --quiet             Be quiet with output printing.
 ```
diff --git a/docs/docs/cli/kratos-remote-status.md b/docs/docs/cli/kratos-remote-status.md
index 87aa0f77b..6e19d5594 100644
--- a/docs/docs/cli/kratos-remote-status.md
+++ b/docs/docs/cli/kratos-remote-status.md
@@ -34,7 +34,7 @@ kratos remote status [flags]
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-remote-version.md b/docs/docs/cli/kratos-remote-version.md
index 23d82a7f0..36c52f3ff 100644
--- a/docs/docs/cli/kratos-remote-version.md
+++ b/docs/docs/cli/kratos-remote-version.md
@@ -32,7 +32,7 @@ kratos remote version [flags]
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -q, --quiet             Be quiet with output printing.
 ```
 
diff --git a/docs/docs/cli/kratos-remote.md b/docs/docs/cli/kratos-remote.md
index a92ae04d0..5eb34dc37 100644
--- a/docs/docs/cli/kratos-remote.md
+++ b/docs/docs/cli/kratos-remote.md
@@ -23,7 +23,7 @@ Helpers and management for remote ORY Kratos instances
 
 ```
   -e, --endpoint string   The URL of ORY Kratos' Admin API. Alternatively set using the KRATOS_ADMIN_URL environmental variable.
-  -f, --format string     Set the output format. One of table, json, and json-pretty.
+  -f, --format string     Set the output format. One of table, json, and json-pretty. (default "default")
   -h, --help              help for remote
   -q, --quiet             Be quiet with output printing.
 ```
diff --git a/docs/docs/debug/csrf.mdx b/docs/docs/debug/csrf.mdx
index 6e9e21bd2..2b736ea0c 100644
--- a/docs/docs/debug/csrf.mdx
+++ b/docs/docs/debug/csrf.mdx
@@ -52,6 +52,13 @@ as well as the network tab - look for `Cookie` and `Set-Cookie` HTTP Headers:
   src={useBaseUrl('img/docs/csrf_network_tab.png')}
 />
 
+### SameSite Attribute
+
+If you run ORY Kratos in `--dev` mode, it disables `SameSite=Lax` as Google
+Chrome rejects all cookies that have `SameSite=Lax` but have `secure` set to
+`false`. If you require `SameSite=Lax`, you need to run Ory Kratos with HTTPS
+and not use the `--dev` flag.
+
 ### ORY Kratos running over HTTP without dev-mode enabled
 
 ORY Kratos' cookies have the `Secure` flag enabled by default. This means that
diff --git a/docs/docs/guides/sign-in-with-github-google-facebook-linkedin.mdx b/docs/docs/guides/sign-in-with-github-google-facebook-linkedin.mdx
index 1c7b92d78..4e7b9fa5e 100644
--- a/docs/docs/guides/sign-in-with-github-google-facebook-linkedin.mdx
+++ b/docs/docs/guides/sign-in-with-github-google-facebook-linkedin.mdx
@@ -470,9 +470,10 @@ There are two ways to use the `microsoft` provider for authentication:
    or `contoso.onmicrosoft.com`.
 2. For authenticating any user in the Microsoft identity platform, set the
    `tenant` value to either:
-   - `organizations` to allow users with work or school accounts, or
-   - `consumers` to allow users with personal accounts, or
-   - `common` to allow both kind of accounts.
+
+- `organizations` to allow users with work or school accounts, or
+- `consumers` to allow users with personal accounts, or
+- `common` to allow both kind of accounts.
 
 ## Twitch
 
@@ -551,7 +552,95 @@ selfservice:
 Next, open the login endpoint of the SecureApp and you should see the Twitch
 Login option!
 
-## Google, LinkedIn, Facebook
+## Facebook
+
+### Create Facebook Application
+
+To set up "Sign in with Facebook" you first need a
+[Facebook Developer Account](https://developers.facebook.com/docs/development/register).
+
+Create a
+[Facebook OAuth2 Application](https://developers.facebook.com/docs/development/create-an-app).
+
+Add a "Facebook Login" product to this application.
+
+Select "Settings" in the Products menu.
+
+Set the "Valid OAuth Redirect URIs" to:
+
+```
+https://127.0.0.1:4433/self-service/methods/oidc/callback/facebook
+```
+
+The pattern of this URL is:
+
+```
+https://<domain-of-ory-kratos>:<public-port>/self-service/methods/oidc/callback/<provider-id>
+```
+
+Facebook requires https the redirect URIs!
+
+:::note
+
+While you can use
+[Facebook as an OIDC identity provider](https://developers.facebook.com/docs/facebook-login/),
+Facebook only returns access_token and not id_token. Therefore, ORY Kratos makes
+a request to
+[Facebook's graph.facebook.com/me API](https://graph.facebook.com/me) and adds
+the user info to `std.extVar('claims')`.
+
+:::
+
+### Configuring Kratos
+
+Create a Jsonnet claims mapper as described in
+[OpenID Connect and OAuth2 Credentials](../concepts/credentials/openid-connect-oidc-oauth2.mdx).
+Save the code in
+`<kratos-directory>/contrib/quickstart/kratos/email-password/oidc.facebook.jsonnet`.
+
+```json title="contrib/quickstart/kratos/email-password/oidc.facebook.jsonnet"
+local claims = std.extVar('claims');
+{
+  identity: {
+    traits: {
+      // Allowing unverified email addresses enables account
+      // enumeration attacks, especially if the value is used for
+      // e.g. verification or as a password login identifier.
+      //
+      // It is assumed that Facebook requires a email to be verifed before accessable via Oauth (because they don't provide an email_verified field).
+      //
+      // The email might be empty if the user is not allowed to an email scope.
+      [if "email" in claims then "email" else null]: claims.email,
+    },
+  },
+}
+```
+
+Now, enable the Facebook provider in the ORY Kratos config located at
+`<kratos-directory>/contrib/quickstart/kratos/email-password/kratos.yml`.
+
+```yaml title="contrib/quickstart/kratos/email-password/kratos.yml"
+# $ kratos -c path/to/my/kratos/config.yml serve
+selfservice:
+  methods:
+    oidc:
+      enabled: true
+      config:
+        providers:
+          - id: facebook # this is `<provider-id>` in the Authorization callback URL. DO NOT CHANGE IT ONCE SET!
+            provider: facebook
+            client_id: .... # Replace this with the OAuth2 Client ID provided by Facebook app
+            client_secret: .... # Replace this with the OAuth2 Client Secret provided by Facebook app
+            mapper_url: file:///etc/config/kratos/oidc.facebook.jsonnet
+            scope:
+              - email # required for email and email_verified claims in the near future
+                # other supported scopes: user_gender, user_birthday
+```
+
+Next, open the login endpoint of the SecureApp and you should see the Facebook
+Login option!
+
+## Google, LinkedIn
 
 Connecting with other Social Sign In providers will be very similar to the
 GitHub flow. If you've managed to do it, add to this document by writing it down
diff --git a/docs/docs/reference/api.mdx b/docs/docs/reference/api.mdx
index ecd227717..038c12cae 100644
--- a/docs/docs/reference/api.mdx
+++ b/docs/docs/reference/api.mdx
@@ -417,24 +417,24 @@ This is the number of items per page.
 
 Status Code **200**
 
-| Name                   | Type                                                      | Required | Restrictions | Description                                                                                                                                                                                                                                                               |
-| ---------------------- | --------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| _anonymous_            | [[Identity](#schemaidentity)]                             | false    | none         | [Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity]                                                                                                                                                                      |
-| » id                   | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                      |
-| » recovery_addresses   | [[RecoveryAddress](#schemarecoveryaddress)]               | false    | none         | RecoveryAddresses contains all the addresses that can be used to recover an identity.                                                                                                                                                                                     |
-| »» id                  | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                      |
-| »» value               | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                      |
-| »» via                 | [RecoveryAddressType](#schemarecoveryaddresstype)         | true     | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type                                             |
-| » schema_id            | string                                                    | true     | none         | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.                                                                                                                                                                                    |
-| » schema_url           | string                                                    | true     | none         | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url                                                                                                                                                                  |
-| » traits               | [Traits](#schematraits)                                   | true     | none         | Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits                                                                                                                                                                                              |
-| » verifiable_addresses | [[VerifiableAddress](#schemaverifiableaddress)]           | false    | none         | VerifiableAddresses contains all the addresses that can be verified by the user.                                                                                                                                                                                          |
-| »» id                  | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                      |
-| »» status              | [VerifiableAddressStatus](#schemaverifiableaddressstatus) | true     | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
-| »» value               | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                      |
-| »» verified            | boolean                                                   | true     | none         | none                                                                                                                                                                                                                                                                      |
-| »» verified_at         | [NullTime](#schemanulltime)(date-time)                    | false    | none         | none                                                                                                                                                                                                                                                                      |
-| »» via                 | [VerifiableAddressType](#schemaverifiableaddresstype)     | true     | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type                       |
+| Name                   | Type                                                      | Required | Restrictions | Description                                                                                                                                                                                                                                                                                       |
+| ---------------------- | --------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| _anonymous_            | [[Identity](#schemaidentity)]                             | false    | none         | [Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity]                                                                                                                                                                                     |
+| » id                   | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| » recovery_addresses   | [[RecoveryAddress](#schemarecoveryaddress)]               | false    | none         | RecoveryAddresses contains all the addresses that can be used to recover an identity.                                                                                                                                                                                                             |
+| »» id                  | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| »» value               | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| »» via                 | [RecoveryAddressType](#schemarecoveryaddresstype)         | true     | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type                                                 |
+| » schema_id            | string                                                    | true     | none         | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.                                                                                                                                                                                                            |
+| » schema_url           | string                                                    | true     | none         | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url                                                                                                                                                                                          |
+| » traits               | [Traits](#schematraits)                                   | true     | none         | Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits                                                                                                                                                                                                               |
+| » verifiable_addresses | [[VerifiableAddress](#schemaverifiableaddress)]           | false    | none         | VerifiableAddresses contains all the addresses that can be verified by the user.                                                                                                                                                                                                                  |
+| »» id                  | [UUID](#schemauuid)(uuid4)                                | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| »» status              | [VerifiableAddressStatus](#schemaverifiableaddressstatus) | true     | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
+| »» value               | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| »» verified            | boolean                                                   | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| »» verified_at         | [NullTime](#schemanulltime)(date-time)                    | false    | none         | none                                                                                                                                                                                                                                                                                              |
+| »» via                 | [VerifiableAddressType](#schemaverifiableaddresstype)     | true     | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type                         |
 
 ##### Examples
 
@@ -8585,6 +8585,7 @@ CompleteSelfServiceLoginFlowWithPasswordMethod
 CompleteSelfServiceLoginFlowWithPasswordMethod
 CompleteSelfServiceLoginFlowWithPasswordMethod
 CompleteSelfServiceLoginFlowWithPasswordMethod
+CompleteSelfServiceLoginFlowWithPasswordMethod
 CompleteSelfServiceLoginFlowWithPasswordMethod complete self service login flow
 with password method_
 
@@ -8618,6 +8619,7 @@ CompleteSelfServiceSettingsFlowWithPasswordMethod
 CompleteSelfServiceSettingsFlowWithPasswordMethod
 CompleteSelfServiceSettingsFlowWithPasswordMethod
 CompleteSelfServiceSettingsFlowWithPasswordMethod
+CompleteSelfServiceSettingsFlowWithPasswordMethod
 CompleteSelfServiceSettingsFlowWithPasswordMethod complete self service settings
 flow with password method_
 
@@ -8643,7 +8645,7 @@ flow with password method_
 
 _CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity
 CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity
-create identity_
+CreateIdentity create identity_
 
 #### Properties
 
@@ -8667,7 +8669,7 @@ create identity_
 
 _CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink
 CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink
-CreateRecoveryLink CreateRecoveryLink create recovery link_
+CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink create recovery link_
 
 #### Properties
 
@@ -8705,13 +8707,13 @@ credentials, passwordless credentials,_
 0
 ```
 
-_ID ID ID ID ID ID ID ID ID ID ID_
+_ID ID ID ID ID ID ID ID ID ID ID ID_
 
 #### Properties
 
-| Name        | Type           | Required | Restrictions | Description                      |
-| ----------- | -------------- | -------- | ------------ | -------------------------------- |
-| _anonymous_ | integer(int64) | false    | none         | ID ID ID ID ID ID ID ID ID ID ID |
+| Name        | Type           | Required | Restrictions | Description                         |
+| ----------- | -------------- | -------- | ------------ | ----------------------------------- |
+| _anonymous_ | integer(int64) | false    | none         | ID ID ID ID ID ID ID ID ID ID ID ID |
 
 <a id="tocSidentity"></a>
 
@@ -8746,7 +8748,7 @@ _ID ID ID ID ID ID ID ID ID ID ID_
 ```
 
 _Identity Identity Identity Identity Identity Identity Identity Identity
-Identity Identity identity_
+Identity Identity Identity identity_
 
 #### Properties
 
@@ -8756,7 +8758,7 @@ Identity Identity identity_
 | recovery_addresses   | [[RecoveryAddress](#schemarecoveryaddress)]     | false    | none         | RecoveryAddresses contains all the addresses that can be used to recover an identity.                    |
 | schema_id            | string                                          | true     | none         | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.                   |
 | schema_url           | string                                          | true     | none         | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
-| traits               | [Traits](#schematraits)                         | true     | none         | Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits                             |
+| traits               | [Traits](#schematraits)                         | true     | none         | Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits                      |
 | verifiable_addresses | [[VerifiableAddress](#schemaverifiableaddress)] | false    | none         | VerifiableAddresses contains all the addresses that can be verified by the user.                         |
 
 <a id="tocSmessage"></a>
@@ -8775,14 +8777,14 @@ Identity Identity identity_
 ```
 
 _Message Message Message Message Message Message Message Message Message Message
-message_
+Message message_
 
 #### Properties
 
 | Name    | Type                | Required | Restrictions | Description                                     |
 | ------- | ------------------- | -------- | ------------ | ----------------------------------------------- |
 | context | object              | false    | none         | context                                         |
-| id      | [ID](#schemaid)     | false    | none         | ID ID ID ID ID ID ID ID ID ID ID                |
+| id      | [ID](#schemaid)     | false    | none         | ID ID ID ID ID ID ID ID ID ID ID ID             |
 | text    | string              | false    | none         | text                                            |
 | type    | [Type](#schematype) | false    | none         | The flow type can either be `api` or `browser`. |
 
@@ -8804,13 +8806,13 @@ message_
 ```
 
 _Messages Messages Messages Messages Messages Messages Messages Messages
-Messages Messages messages_
+Messages Messages Messages messages_
 
 #### Properties
 
-| Name        | Type                        | Required | Restrictions | Description                                                                                        |
-| ----------- | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| _anonymous_ | [[Message](#schemamessage)] | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| Name        | Type                        | Required | Restrictions | Description                                                                                                 |
+| ----------- | --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| _anonymous_ | [[Message](#schemamessage)] | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
 
 <a id="tocSnulltime"></a>
 
@@ -8846,15 +8848,15 @@ _NullTime implements sql.NullTime functionality._
 
 _RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress
 RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress
-recovery address_
+RecoveryAddress recovery address_
 
 #### Properties
 
-| Name  | Type                                              | Required | Restrictions | Description                                                                                                                                                                                                                   |
-| ----- | ------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| id    | [UUID](#schemauuid)                               | true     | none         | none                                                                                                                                                                                                                          |
-| value | string                                            | true     | none         | none                                                                                                                                                                                                                          |
-| via   | [RecoveryAddressType](#schemarecoveryaddresstype) | true     | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type |
+| Name  | Type                                              | Required | Restrictions | Description                                                                                                                                                                                                                                       |
+| ----- | ------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| id    | [UUID](#schemauuid)                               | true     | none         | none                                                                                                                                                                                                                                              |
+| value | string                                            | true     | none         | none                                                                                                                                                                                                                                              |
+| via   | [RecoveryAddressType](#schemarecoveryaddresstype) | true     | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type |
 
 <a id="tocSrecoveryaddresstype"></a>
 
@@ -8868,13 +8870,14 @@ recovery address_
 
 _RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType
 RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType
-RecoveryAddressType RecoveryAddressType recovery address type_
+RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address
+type_
 
 #### Properties
 
-| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                   |
-| ----------- | ------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| _anonymous_ | string | false    | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type |
+| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                       |
+| ----------- | ------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| _anonymous_ | string | false    | none         | RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type |
 
 <a id="tocSstate"></a>
 
@@ -8886,13 +8889,13 @@ RecoveryAddressType RecoveryAddressType recovery address type_
 "string"
 ```
 
-_State State State State State State State State State State state_
+_State State State State State State State State State State State state_
 
 #### Properties
 
-| Name        | Type   | Required | Restrictions | Description                                                       |
-| ----------- | ------ | -------- | ------------ | ----------------------------------------------------------------- |
-| _anonymous_ | string | false    | none         | State State State State State State State State State State state |
+| Name        | Type   | Required | Restrictions | Description                                                             |
+| ----------- | ------ | -------- | ------------ | ----------------------------------------------------------------------- |
+| _anonymous_ | string | false    | none         | State State State State State State State State State State State state |
 
 <a id="tocStraits"></a>
 
@@ -8904,7 +8907,8 @@ _State State State State State State State State State State state_
 {}
 ```
 
-_Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits_
+_Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits
+traits_
 
 #### Properties
 
@@ -8959,7 +8963,7 @@ _Type is the flow type._
 
 _UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity
 UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity
-update identity_
+UpdateIdentity update identity_
 
 #### Properties
 
@@ -8987,18 +8991,18 @@ update identity_
 
 _VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress
 VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress
-VerifiableAddress VerifiableAddress verifiable address_
+VerifiableAddress VerifiableAddress VerifiableAddress verifiable address_
 
 #### Properties
 
-| Name        | Type                                                      | Required | Restrictions | Description                                                                                                                                                                                                                                                               |
-| ----------- | --------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| id          | [UUID](#schemauuid)                                       | true     | none         | none                                                                                                                                                                                                                                                                      |
-| status      | [VerifiableAddressStatus](#schemaverifiableaddressstatus) | true     | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
-| value       | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                      |
-| verified    | boolean                                                   | true     | none         | none                                                                                                                                                                                                                                                                      |
-| verified_at | [NullTime](#schemanulltime)                               | false    | none         | none                                                                                                                                                                                                                                                                      |
-| via         | [VerifiableAddressType](#schemaverifiableaddresstype)     | true     | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type                       |
+| Name        | Type                                                      | Required | Restrictions | Description                                                                                                                                                                                                                                                                                       |
+| ----------- | --------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| id          | [UUID](#schemauuid)                                       | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| status      | [VerifiableAddressStatus](#schemaverifiableaddressstatus) | true     | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
+| value       | string                                                    | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| verified    | boolean                                                   | true     | none         | none                                                                                                                                                                                                                                                                                              |
+| verified_at | [NullTime](#schemanulltime)                               | false    | none         | none                                                                                                                                                                                                                                                                                              |
+| via         | [VerifiableAddressType](#schemaverifiableaddresstype)     | true     | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type                         |
 
 <a id="tocSverifiableaddressstatus"></a>
 
@@ -9013,13 +9017,13 @@ VerifiableAddress VerifiableAddress verifiable address_
 _VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus
 VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus
 VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus
-VerifiableAddressStatus verifiable address status_
+VerifiableAddressStatus VerifiableAddressStatus verifiable address status_
 
 #### Properties
 
-| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                                               |
-| ----------- | ------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| _anonymous_ | string | false    | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
+| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                                                                       |
+| ----------- | ------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| _anonymous_ | string | false    | none         | VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status |
 
 <a id="tocSverifiableaddresstype"></a>
 
@@ -9034,13 +9038,13 @@ VerifiableAddressStatus verifiable address status_
 _VerifiableAddressType VerifiableAddressType VerifiableAddressType
 VerifiableAddressType VerifiableAddressType VerifiableAddressType
 VerifiableAddressType VerifiableAddressType VerifiableAddressType
-VerifiableAddressType verifiable address type_
+VerifiableAddressType VerifiableAddressType verifiable address type_
 
 #### Properties
 
-| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                         |
-| ----------- | ------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| _anonymous_ | string | false    | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type |
+| Name        | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                                               |
+| ----------- | ------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| _anonymous_ | string | false    | none         | VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type |
 
 <a id="tocScompleteselfservicerecoveryflowwithlinkmethod"></a>
 
@@ -9064,6 +9068,7 @@ CompleteSelfServiceRecoveryFlowWithLinkMethod
 CompleteSelfServiceRecoveryFlowWithLinkMethod
 CompleteSelfServiceRecoveryFlowWithLinkMethod
 CompleteSelfServiceRecoveryFlowWithLinkMethod
+CompleteSelfServiceRecoveryFlowWithLinkMethod
 CompleteSelfServiceRecoveryFlowWithLinkMethod complete self service recovery
 flow with link method_
 
@@ -9096,6 +9101,7 @@ CompleteSelfServiceVerificationFlowWithLinkMethod
 CompleteSelfServiceVerificationFlowWithLinkMethod
 CompleteSelfServiceVerificationFlowWithLinkMethod
 CompleteSelfServiceVerificationFlowWithLinkMethod
+CompleteSelfServiceVerificationFlowWithLinkMethod
 CompleteSelfServiceVerificationFlowWithLinkMethod complete self service
 verification flow with link method_
 
@@ -9155,15 +9161,15 @@ _Field represents a HTML Form Field_
 
 #### Properties
 
-| Name     | Type                        | Required | Restrictions | Description                                                                                        |
-| -------- | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| disabled | boolean                     | false    | none         | Disabled is the equivalent of `<input {{if .Disabled}}disabled{{end}}">`                           |
-| messages | [Messages](#schemamessages) | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| name     | string                      | true     | none         | Name is the equivalent of `<input name="{{.Name}}">`                                               |
-| pattern  | string                      | false    | none         | Pattern is the equivalent of `<input pattern="{{.Pattern}}">`                                      |
-| required | boolean                     | false    | none         | Required is the equivalent of `<input required="{{.Required}}">`                                   |
-| type     | string                      | true     | none         | Type is the equivalent of `<input type="{{.Type}}">`                                               |
-| value    | object                      | false    | none         | Value is the equivalent of `<input value="{{.Value}}">`                                            |
+| Name     | Type                        | Required | Restrictions | Description                                                                                                 |
+| -------- | --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| disabled | boolean                     | false    | none         | Disabled is the equivalent of `<input {{if .Disabled}}disabled{{end}}">`                                    |
+| messages | [Messages](#schemamessages) | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| name     | string                      | true     | none         | Name is the equivalent of `<input name="{{.Name}}">`                                                        |
+| pattern  | string                      | false    | none         | Pattern is the equivalent of `<input pattern="{{.Pattern}}">`                                               |
+| required | boolean                     | false    | none         | Required is the equivalent of `<input required="{{.Required}}">`                                            |
+| type     | string                      | true     | none         | Type is the equivalent of `<input type="{{.Type}}">`                                                        |
+| value    | object                      | false    | none         | Value is the equivalent of `<input value="{{.Value}}">`                                                     |
 
 <a id="tocSformfields"></a>
 
@@ -9220,13 +9226,13 @@ _FormFields Fields contains multiple fields_
 }
 ```
 
-_GenericError Error response_
+_Error response_
 
 #### Properties
 
-| Name  | Type                                              | Required | Restrictions | Description                                                                                                                                                                                                                   |
-| ----- | ------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| error | [genericErrorPayload](#schemagenericerrorpayload) | false    | none         | GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload |
+| Name  | Type                                              | Required | Restrictions | Description                                                                                                                                                                                                                                       |
+| ----- | ------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| error | [genericErrorPayload](#schemagenericerrorpayload) | false    | none         | GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload |
 
 <a id="tocSgenericerrorpayload"></a>
 
@@ -9248,7 +9254,8 @@ _GenericError Error response_
 
 _GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload
 GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload
-GenericErrorPayload GenericErrorPayload generic error payload_
+GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error
+payload_
 
 #### Properties
 
@@ -9277,6 +9284,8 @@ GenericErrorPayload GenericErrorPayload generic error payload_
 }
 ```
 
+_HealthNotReadyStatus health not ready status_
+
 #### Properties
 
 | Name                       | Type   | Required | Restrictions | Description                                                        |
@@ -9296,6 +9305,8 @@ GenericErrorPayload GenericErrorPayload generic error payload_
 }
 ```
 
+_HealthStatus HealthStatus health status_
+
 #### Properties
 
 | Name   | Type   | Required | Restrictions | Description                  |
@@ -9443,9 +9454,9 @@ _Login Flow_
 | forced                     | boolean                                   | false    | none         | Forced stores whether this login flow should enforce re-authentication.                                                                                                                                                                          |
 | id                         | [UUID](#schemauuid)                       | true     | none         | none                                                                                                                                                                                                                                             |
 | issued_at                  | string(date-time)                         | true     | none         | IssuedAt is the time (UTC) when the flow started.                                                                                                                                                                                                |
-| messages                   | [Messages](#schemamessages)               | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                                                                                               |
+| messages                   | [Messages](#schemamessages)               | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                                                                                      |
 | methods                    | object                                    | true     | none         | List of login methods This is the list of available login methods with their required form fields, such as `identifier` and `password` for the password login method. This will also contain error messages such as "password can not be empty". |
-| » **additionalProperties** | [loginFlowMethod](#schemaloginflowmethod) | false    | none         | none                                                                                                                                                                                                                                             |
+| » **additionalProperties** | [loginFlowMethod](#schemaloginflowmethod) | false    | none         | LoginFlowMethod login flow method                                                                                                                                                                                                                |
 | request_url                | string                                    | true     | none         | RequestURL is the initial URL that was requested from ORY Kratos. It can be used to forward information contained in the URL's path or query for example.                                                                                        |
 | type                       | [Type](#schematype)                       | false    | none         | The flow type can either be `api` or `browser`.                                                                                                                                                                                                  |
 
@@ -9509,12 +9520,14 @@ _Login Flow_
 }
 ```
 
+_LoginFlowMethod login flow method_
+
 #### Properties
 
-| Name   | Type                                                  | Required | Restrictions | Description                                                          |
-| ------ | ----------------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------- |
-| config | [loginFlowMethodConfig](#schemaloginflowmethodconfig) | true     | none         | LoginFlowMethodConfig LoginFlowMethodConfig login flow method config |
-| method | [CredentialsType](#schemacredentialstype)             | true     | none         | and so on.                                                           |
+| Name   | Type                                                  | Required | Restrictions | Description |
+| ------ | ----------------------------------------------------- | -------- | ------------ | ----------- |
+| config | [loginFlowMethodConfig](#schemaloginflowmethodconfig) | true     | none         | none        |
+| method | [CredentialsType](#schemacredentialstype)             | true     | none         | and so on.  |
 
 <a id="tocSloginflowmethodconfig"></a>
 
@@ -9573,17 +9586,15 @@ _Login Flow_
 }
 ```
 
-_LoginFlowMethodConfig LoginFlowMethodConfig login flow method config_
-
 #### Properties
 
-| Name      | Type                            | Required | Restrictions | Description                                                                                        |
-| --------- | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| action    | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.        |
-| fields    | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                         |
-| messages  | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| method    | string                          | true     | none         | Method is the form method (e.g. POST)                                                              |
-| providers | [[formField](#schemaformfield)] | false    | none         | Providers is set for the "oidc" flow method.                                                       |
+| Name      | Type                            | Required | Restrictions | Description                                                                                                 |
+| --------- | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| action    | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.                 |
+| fields    | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                                  |
+| messages  | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| method    | string                          | true     | none         | Method is the form method (e.g. POST)                                                                       |
+| providers | [[formField](#schemaformfield)] | false    | none         | Providers is set for the "oidc" flow method.                                                                |
 
 <a id="tocSloginviaapiresponse"></a>
 
@@ -9627,13 +9638,13 @@ _LoginFlowMethodConfig LoginFlowMethodConfig login flow method config_
 }
 ```
 
-_LoginViaAPIResponse LoginViaAPIResponse The Response for Login Flows via API_
+_The Response for Login Flows via API_
 
 #### Properties
 
 | Name          | Type                      | Required | Restrictions | Description                                                                                                                                                                                                                             |
 | ------------- | ------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| session       | [session](#schemasession) | true     | none         | Session Session session                                                                                                                                                                                                                 |
+| session       | [session](#schemasession) | true     | none         | Session session                                                                                                                                                                                                                         |
 | session_token | string                    | true     | none         | The Session Token A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for API flows, not for Browser flows! |
 
 <a id="tocSrecoveryflow"></a>
@@ -9730,7 +9741,7 @@ _LoginViaAPIResponse LoginViaAPIResponse The Response for Login Flows via API_
 }
 ```
 
-_A Recovery Flow_
+_RecoveryFlow A Recovery Flow_
 
 #### Properties
 
@@ -9740,11 +9751,11 @@ _A Recovery Flow_
 | expires_at                 | string(date-time)                               | true     | none         | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated.                                              |
 | id                         | [UUID](#schemauuid)                             | true     | none         | none                                                                                                                                                                                  |
 | issued_at                  | string(date-time)                               | true     | none         | IssuedAt is the time (UTC) when the request occurred.                                                                                                                                 |
-| messages                   | [Messages](#schemamessages)                     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                                    |
+| messages                   | [Messages](#schemamessages)                     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                           |
 | methods                    | object                                          | true     | none         | Methods contains context for all account recovery methods. If a registration request has been processed, but for example the password is incorrect, this will contain error messages. |
-| » **additionalProperties** | [recoveryFlowMethod](#schemarecoveryflowmethod) | false    | none         | RecoveryFlowMethod recovery flow method                                                                                                                                               |
+| » **additionalProperties** | [recoveryFlowMethod](#schemarecoveryflowmethod) | false    | none         | none                                                                                                                                                                                  |
 | request_url                | string                                          | true     | none         | RequestURL is the initial URL that was requested from ORY Kratos. It can be used to forward information contained in the URL's path or query for example.                             |
-| state                      | [State](#schemastate)                           | true     | none         | State State State State State State State State State State state                                                                                                                     |
+| state                      | [State](#schemastate)                           | true     | none         | State State State State State State State State State State State state                                                                                                               |
 | type                       | [Type](#schematype)                             | false    | none         | The flow type can either be `api` or `browser`.                                                                                                                                       |
 
 <a id="tocSrecoveryflowmethod"></a>
@@ -9789,14 +9800,12 @@ _A Recovery Flow_
 }
 ```
 
-_RecoveryFlowMethod recovery flow method_
-
 #### Properties
 
-| Name   | Type                                                        | Required | Restrictions | Description                                                                                                                                              |
-| ------ | ----------------------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| config | [recoveryFlowMethodConfig](#schemarecoveryflowmethodconfig) | true     | none         | RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config |
-| method | string                                                      | true     | none         | Method contains the request credentials type.                                                                                                            |
+| Name   | Type                                                        | Required | Restrictions | Description                                   |
+| ------ | ----------------------------------------------------------- | -------- | ------------ | --------------------------------------------- |
+| config | [recoveryFlowMethodConfig](#schemarecoveryflowmethodconfig) | true     | none         | none                                          |
+| method | string                                                      | true     | none         | Method contains the request credentials type. |
 
 <a id="tocSrecoveryflowmethodconfig"></a>
 
@@ -9837,17 +9846,14 @@ _RecoveryFlowMethod recovery flow method_
 }
 ```
 
-_RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig
-RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config_
-
 #### Properties
 
-| Name     | Type                            | Required | Restrictions | Description                                                                                        |
-| -------- | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.        |
-| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                         |
-| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                              |
+| Name     | Type                            | Required | Restrictions | Description                                                                                                 |
+| -------- | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.                 |
+| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                                  |
+| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                                       |
 
 <a id="tocSrecoverylink"></a>
 
@@ -9862,12 +9868,14 @@ RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config_
 }
 ```
 
+_RecoveryLink RecoveryLink recovery link_
+
 #### Properties
 
-| Name          | Type              | Required | Restrictions | Description                                                            |
-| ------------- | ----------------- | -------- | ------------ | ---------------------------------------------------------------------- |
-| expires_at    | string(date-time) | false    | none         | Recovery Link Expires At The timestamp when the recovery link expires. |
-| recovery_link | string            | true     | none         | Recovery Link This link can be used to recover the account.            |
+| Name          | Type              | Required | Restrictions | Description                                                                                                |
+| ------------- | ----------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------- |
+| expires_at    | string(date-time) | false    | none         | Recovery Link Expires At The timestamp when the recovery link expires. Format: date-time Format: date-time |
+| recovery_link | string            | true     | none         | Recovery Link This link can be used to recover the account.                                                |
 
 <a id="tocSregistrationflow"></a>
 
@@ -10006,9 +10014,9 @@ RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config_
 | expires_at                 | string(date-time)                                       | true     | none         | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.                                                                 |
 | id                         | [UUID](#schemauuid)                                     | true     | none         | none                                                                                                                                                                                   |
 | issued_at                  | string(date-time)                                       | true     | none         | IssuedAt is the time (UTC) when the flow occurred.                                                                                                                                     |
-| messages                   | [Messages](#schemamessages)                             | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                                     |
+| messages                   | [Messages](#schemamessages)                             | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                            |
 | methods                    | object                                                  | true     | none         | Methods contains context for all enabled registration methods. If a registration flow has been processed, but for example the password is incorrect, this will contain error messages. |
-| » **additionalProperties** | [registrationFlowMethod](#schemaregistrationflowmethod) | false    | none         | RegistrationFlowMethod registration flow method                                                                                                                                        |
+| » **additionalProperties** | [registrationFlowMethod](#schemaregistrationflowmethod) | false    | none         | none                                                                                                                                                                                   |
 | request_url                | string                                                  | true     | none         | RequestURL is the initial URL that was requested from ORY Kratos. It can be used to forward information contained in the URL's path or query for example.                              |
 | type                       | [Type](#schematype)                                     | false    | none         | The flow type can either be `api` or `browser`.                                                                                                                                        |
 
@@ -10072,14 +10080,12 @@ RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config_
 }
 ```
 
-_RegistrationFlowMethod registration flow method_
-
 #### Properties
 
-| Name   | Type                                                                | Required | Restrictions | Description |
-| ------ | ------------------------------------------------------------------- | -------- | ------------ | ----------- |
-| config | [registrationFlowMethodConfig](#schemaregistrationflowmethodconfig) | true     | none         | none        |
-| method | [CredentialsType](#schemacredentialstype)                           | true     | none         | and so on.  |
+| Name   | Type                                                                | Required | Restrictions | Description                                                                               |
+| ------ | ------------------------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------- |
+| config | [registrationFlowMethodConfig](#schemaregistrationflowmethodconfig) | true     | none         | RegistrationFlowMethodConfig RegistrationFlowMethodConfig registration flow method config |
+| method | [CredentialsType](#schemacredentialstype)                           | true     | none         | and so on.                                                                                |
 
 <a id="tocSregistrationflowmethodconfig"></a>
 
@@ -10138,15 +10144,18 @@ _RegistrationFlowMethod registration flow method_
 }
 ```
 
+_RegistrationFlowMethodConfig RegistrationFlowMethodConfig registration flow
+method config_
+
 #### Properties
 
-| Name      | Type                            | Required | Restrictions | Description                                                                                        |
-| --------- | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| action    | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.        |
-| fields    | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                         |
-| messages  | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| method    | string                          | true     | none         | Method is the form method (e.g. POST)                                                              |
-| providers | [[formField](#schemaformfield)] | false    | none         | Providers is set for the "oidc" registration method.                                               |
+| Name      | Type                            | Required | Restrictions | Description                                                                                                 |
+| --------- | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| action    | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.                 |
+| fields    | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                                  |
+| messages  | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| method    | string                          | true     | none         | Method is the form method (e.g. POST)                                                                       |
+| providers | [[formField](#schemaformfield)] | false    | none         | Providers is set for the "oidc" registration method.                                                        |
 
 <a id="tocSregistrationviaapiresponse"></a>
 
@@ -10219,8 +10228,8 @@ _RegistrationViaAPIResponse The Response for Registration Flows via API_
 
 | Name          | Type                        | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                                     |
 | ------------- | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| identity      | [Identity](#schemaidentity) | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                                                                                                                                                                              |
-| session       | [session](#schemasession)   | false    | none         | Session Session session                                                                                                                                                                                                                                                                                                         |
+| identity      | [Identity](#schemaidentity) | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                                                                                                                                                                     |
+| session       | [session](#schemasession)   | false    | none         | Session session                                                                                                                                                                                                                                                                                                                 |
 | session_token | string                      | true     | none         | The Session Token This field is only set when the session hook is configured as a post-registration hook. A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for API flows, not for Browser flows! |
 
 <a id="tocSrevokesession"></a>
@@ -10236,8 +10245,8 @@ _RegistrationViaAPIResponse The Response for Registration Flows via API_
 ```
 
 _RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession
-RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession revoke
-session_
+RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession
+RevokeSession revoke session_
 
 #### Properties
 
@@ -10284,18 +10293,18 @@ session_
 }
 ```
 
-_Session Session session_
+_Session session_
 
 #### Properties
 
-| Name             | Type                        | Required | Restrictions | Description                                                                                        |
-| ---------------- | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| active           | boolean                     | false    | none         | active                                                                                             |
-| authenticated_at | string(date-time)           | true     | none         | authenticated at                                                                                   |
-| expires_at       | string(date-time)           | true     | none         | expires at                                                                                         |
-| id               | [UUID](#schemauuid)         | true     | none         | none                                                                                               |
-| identity         | [Identity](#schemaidentity) | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity |
-| issued_at        | string(date-time)           | true     | none         | issued at                                                                                          |
+| Name             | Type                        | Required | Restrictions | Description                                                                                                 |
+| ---------------- | --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| active           | boolean                     | false    | none         | active                                                                                                      |
+| authenticated_at | string(date-time)           | true     | none         | authenticated at                                                                                            |
+| expires_at       | string(date-time)           | true     | none         | expires at                                                                                                  |
+| id               | [UUID](#schemauuid)         | true     | none         | none                                                                                                        |
+| identity         | [Identity](#schemaidentity) | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity |
+| issued_at        | string(date-time)           | true     | none         | issued at                                                                                                   |
 
 <a id="tocSsettingsflow"></a>
 
@@ -10414,7 +10423,7 @@ _Session Session session_
 }
 ```
 
-_SettingsFlow Flow represents a Settings Flow_
+_SettingsFlow SettingsFlow Flow represents a Settings Flow_
 
 #### Properties
 
@@ -10423,13 +10432,13 @@ _SettingsFlow Flow represents a Settings Flow_
 | active                     | string                                          | false    | none         | Active, if set, contains the registration method that is being used. It is initially not set.                                                                                    |
 | expires_at                 | string(date-time)                               | true     | none         | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.                                               |
 | id                         | [UUID](#schemauuid)                             | true     | none         | none                                                                                                                                                                             |
-| identity                   | [Identity](#schemaidentity)                     | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                               |
+| identity                   | [Identity](#schemaidentity)                     | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                      |
 | issued_at                  | string(date-time)                               | true     | none         | IssuedAt is the time (UTC) when the flow occurred.                                                                                                                               |
-| messages                   | [Messages](#schemamessages)                     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                               |
+| messages                   | [Messages](#schemamessages)                     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                      |
 | methods                    | object                                          | true     | none         | Methods contains context for all enabled registration methods. If a settings flow has been processed, but for example the first name is empty, this will contain error messages. |
-| » **additionalProperties** | [settingsFlowMethod](#schemasettingsflowmethod) | false    | none         | none                                                                                                                                                                             |
+| » **additionalProperties** | [settingsFlowMethod](#schemasettingsflowmethod) | false    | none         | SettingsFlowMethod settings flow method                                                                                                                                          |
 | request_url                | string                                          | true     | none         | RequestURL is the initial URL that was requested from ORY Kratos. It can be used to forward information contained in the URL's path or query for example.                        |
-| state                      | [State](#schemastate)                           | true     | none         | State State State State State State State State State State state                                                                                                                |
+| state                      | [State](#schemastate)                           | true     | none         | State State State State State State State State State State State state                                                                                                          |
 | type                       | [Type](#schematype)                             | false    | none         | The flow type can either be `api` or `browser`.                                                                                                                                  |
 
 <a id="tocSsettingsflowmethod"></a>
@@ -10474,12 +10483,14 @@ _SettingsFlow Flow represents a Settings Flow_
 }
 ```
 
+_SettingsFlowMethod settings flow method_
+
 #### Properties
 
-| Name   | Type                                                        | Required | Restrictions | Description                                          |
-| ------ | ----------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------- |
-| config | [settingsFlowMethodConfig](#schemasettingsflowmethodconfig) | true     | none         | SettingsFlowMethodConfig settings flow method config |
-| method | string                                                      | true     | none         | Method is the name of this flow method.              |
+| Name   | Type                                                        | Required | Restrictions | Description                             |
+| ------ | ----------------------------------------------------------- | -------- | ------------ | --------------------------------------- |
+| config | [settingsFlowMethodConfig](#schemasettingsflowmethodconfig) | true     | none         | none                                    |
+| method | string                                                      | true     | none         | Method is the name of this flow method. |
 
 <a id="tocSsettingsflowmethodconfig"></a>
 
@@ -10520,16 +10531,14 @@ _SettingsFlow Flow represents a Settings Flow_
 }
 ```
 
-_SettingsFlowMethodConfig settings flow method config_
-
 #### Properties
 
-| Name     | Type                            | Required | Restrictions | Description                                                                                        |
-| -------- | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.        |
-| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                         |
-| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                              |
+| Name     | Type                            | Required | Restrictions | Description                                                                                                 |
+| -------- | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.                 |
+| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                                  |
+| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                                       |
 
 <a id="tocSsettingsviaapiresponse"></a>
 
@@ -10673,15 +10682,15 @@ _SettingsFlowMethodConfig settings flow method config_
 }
 ```
 
-_SettingsViaAPIResponse SettingsViaAPIResponse The Response for Settings Flows
-via API_
+_SettingsViaAPIResponse SettingsViaAPIResponse SettingsViaAPIResponse The
+Response for Settings Flows via API_
 
 #### Properties
 
 | Name     | Type                                | Required | Restrictions | Description                                                                                                                                                                                                          |
 | -------- | ----------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | flow     | [settingsFlow](#schemasettingsflow) | true     | none         | This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings) |
-| identity | [Identity](#schemaidentity)         | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                                                                   |
+| identity | [Identity](#schemaidentity)         | true     | none         | Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity                                                                                                          |
 
 <a id="tocSverificationflow"></a>
 
@@ -10777,21 +10786,21 @@ via API_
 }
 ```
 
-_VerificationFlow A Verification Flow_
+_VerificationFlow VerificationFlow A Verification Flow_
 
 #### Properties
 
 | Name                       | Type                                                    | Required | Restrictions | Description                                                                                                                                                                               |
 | -------------------------- | ------------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | active                     | string                                                  | false    | none         | Active, if set, contains the registration method that is being used. It is initially not set.                                                                                             |
-| expires_at                 | string(date-time)                                       | false    | none         | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. Format: date-time                                |
+| expires_at                 | string(date-time)                                       | false    | none         | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. Format: date-time Format: date-time              |
 | id                         | [UUID](#schemauuid)                                     | false    | none         | none                                                                                                                                                                                      |
-| issued_at                  | string(date-time)                                       | false    | none         | IssuedAt is the time (UTC) when the request occurred. Format: date-time                                                                                                                   |
-| messages                   | [Messages](#schemamessages)                             | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                                        |
+| issued_at                  | string(date-time)                                       | false    | none         | IssuedAt is the time (UTC) when the request occurred. Format: date-time Format: date-time                                                                                                 |
+| messages                   | [Messages](#schemamessages)                             | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages                                                                               |
 | methods                    | object                                                  | true     | none         | Methods contains context for all account verification methods. If a registration request has been processed, but for example the password is incorrect, this will contain error messages. |
 | » **additionalProperties** | [verificationFlowMethod](#schemaverificationflowmethod) | false    | none         | VerificationFlowMethod verification flow method                                                                                                                                           |
 | request_url                | string                                                  | false    | none         | RequestURL is the initial URL that was requested from ORY Kratos. It can be used to forward information contained in the URL's path or query for example.                                 |
-| state                      | [State](#schemastate)                                   | true     | none         | State State State State State State State State State State state                                                                                                                         |
+| state                      | [State](#schemastate)                                   | true     | none         | State State State State State State State State State State State state                                                                                                                   |
 | type                       | [Type](#schematype)                                     | false    | none         | The flow type can either be `api` or `browser`.                                                                                                                                           |
 
 <a id="tocSverificationflowmethod"></a>
@@ -10840,10 +10849,10 @@ _VerificationFlowMethod verification flow method_
 
 #### Properties
 
-| Name   | Type                                                                | Required | Restrictions | Description                                                                               |
-| ------ | ------------------------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------- |
-| config | [verificationFlowMethodConfig](#schemaverificationflowmethodconfig) | true     | none         | VerificationFlowMethodConfig VerificationFlowMethodConfig verification flow method config |
-| method | string                                                              | true     | none         | Method contains the request credentials type.                                             |
+| Name   | Type                                                                | Required | Restrictions | Description                                   |
+| ------ | ------------------------------------------------------------------- | -------- | ------------ | --------------------------------------------- |
+| config | [verificationFlowMethodConfig](#schemaverificationflowmethodconfig) | true     | none         | none                                          |
+| method | string                                                              | true     | none         | Method contains the request credentials type. |
 
 <a id="tocSverificationflowmethodconfig"></a>
 
@@ -10884,17 +10893,14 @@ _VerificationFlowMethod verification flow method_
 }
 ```
 
-_VerificationFlowMethodConfig VerificationFlowMethodConfig verification flow
-method config_
-
 #### Properties
 
-| Name     | Type                            | Required | Restrictions | Description                                                                                        |
-| -------- | ------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- |
-| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.        |
-| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                         |
-| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
-| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                              |
+| Name     | Type                            | Required | Restrictions | Description                                                                                                 |
+| -------- | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------- |
+| action   | string                          | true     | none         | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.                 |
+| fields   | [formFields](#schemaformfields) | true     | none         | FormFields Fields contains multiple fields                                                                  |
+| messages | [Messages](#schemamessages)     | false    | none         | Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages |
+| method   | string                          | true     | none         | Method is the form method (e.g. POST)                                                                       |
 
 <a id="tocSversion"></a>
 
@@ -10908,6 +10914,8 @@ method config_
 }
 ```
 
+_Version Version Version Version Version Version version_
+
 #### Properties
 
 | Name    | Type   | Required | Restrictions | Description                       |
diff --git a/docs/docs/reference/configuration.md b/docs/docs/reference/configuration.md
index 7d827751e..29084101e 100644
--- a/docs/docs/reference/configuration.md
+++ b/docs/docs/reference/configuration.md
@@ -38,11 +38,12 @@ section.
 identity:
   ## JSON Schema URL for default identity traits ##
   #
-  # Path to the JSON Schema which describes a default identity's traits.
+  # URL for JSON Schema which describes a default identity's traits. Can be a file path, a https URL, or a base64 encoded string.
   #
   # Examples:
   # - file://path/to/identity.traits.schema.json
   # - https://foo.bar.com/path/to/identity.traits.schema.json
+  # - base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9
   #
   # Set this value using environment variables on
   # - Linux/macOS:
@@ -56,11 +57,11 @@ identity:
   #
   # Examples:
   # - - id: customer
-  #     url: https://foo.bar.com/path/to/customer.traits.schema.json
+  #     url: base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9
   #   - id: employee
   #     url: https://foo.bar.com/path/to/employee.traits.schema.json
   #   - id: employee-v2
-  #     url: https://foo.bar.com/path/to/employee.v2.traits.schema.json
+  #     url: file://path/to/employee.v2.traits.schema.json
   #
   # Set this value using environment variables on
   # - Linux/macOS:
@@ -70,11 +71,11 @@ identity:
   #
   schemas:
     - id: customer
-      url: https://foo.bar.com/path/to/customer.traits.schema.json
+      url: base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9
     - id: employee
       url: https://foo.bar.com/path/to/employee.traits.schema.json
     - id: employee-v2
-      url: https://foo.bar.com/path/to/employee.v2.traits.schema.json
+      url: file://path/to/employee.v2.traits.schema.json
 
 ## Data Source Name ##
 #
diff --git a/docs/versioned_docs/version-v0.5/admin/managing-users-identities.mdx b/docs/versioned_docs/version-v0.5/admin/managing-users-identities.mdx
index 494e6f384..cc166b010 100644
--- a/docs/versioned_docs/version-v0.5/admin/managing-users-identities.mdx
+++ b/docs/versioned_docs/version-v0.5/admin/managing-users-identities.mdx
@@ -202,5 +202,5 @@ Identity JSON Schema:
 
 For more detailed information and general guidelines on these flows, take a look
 at the
-[Account Recovery and Password Reset](../self-service/flows/account-recovery.md)
-section.
+[Account Recovery and Password Reset](../self-service/flows/account-recovery.mdx)
+section.
\ No newline at end of file
diff --git a/driver/registry_default.go b/driver/registry_default.go
index 8c806ea02..f879a77e6 100644
--- a/driver/registry_default.go
+++ b/driver/registry_default.go
@@ -144,15 +144,15 @@ func (m *RegistryDefault) RegisterPublicRoutes(router *x.RouterPublic) {
 	m.RegistrationHandler().RegisterPublicRoutes(router)
 	m.LogoutHandler().RegisterPublicRoutes(router)
 	m.SettingsHandler().RegisterPublicRoutes(router)
-	m.LoginStrategies().RegisterPublicRoutes(router)
-	m.SettingsStrategies().RegisterPublicRoutes(router)
-	m.RegistrationStrategies().RegisterPublicRoutes(router)
+	m.AllLoginStrategies().RegisterPublicRoutes(router)
+	m.AllSettingsStrategies().RegisterPublicRoutes(router)
+	m.AllRegistrationStrategies().RegisterPublicRoutes(router)
 	m.SessionHandler().RegisterPublicRoutes(router)
 	m.SelfServiceErrorHandler().RegisterPublicRoutes(router)
 	m.SchemaHandler().RegisterPublicRoutes(router)
 
 	if m.c.SelfServiceFlowRecoveryEnabled() {
-		m.RecoveryStrategies().RegisterPublicRoutes(router)
+		m.AllRecoveryStrategies().RegisterPublicRoutes(router)
 		m.RecoveryHandler().RegisterPublicRoutes(router)
 	}
 
@@ -173,7 +173,7 @@ func (m *RegistryDefault) RegisterAdminRoutes(router *x.RouterAdmin) {
 
 	if m.c.SelfServiceFlowRecoveryEnabled() {
 		m.RecoveryHandler().RegisterAdminRoutes(router)
-		m.RecoveryStrategies().RegisterAdminRoutes(router)
+		m.AllRecoveryStrategies().RegisterAdminRoutes(router)
 	}
 
 	m.VerificationHandler().RegisterAdminRoutes(router)
@@ -265,6 +265,17 @@ func (m *RegistryDefault) RegistrationStrategies() registration.Strategies {
 	return m.registrationStrategies
 }
 
+func (m *RegistryDefault) AllRegistrationStrategies() registration.Strategies {
+	var registrationStrategies []registration.Strategy
+
+	for _, strategy := range m.selfServiceStrategies() {
+		if s, ok := strategy.(registration.Strategy); ok {
+			registrationStrategies = append(registrationStrategies, s)
+		}
+	}
+	return registrationStrategies
+}
+
 func (m *RegistryDefault) LoginStrategies() login.Strategies {
 	if len(m.loginStrategies) == 0 {
 		for _, strategy := range m.selfServiceStrategies() {
@@ -278,6 +289,16 @@ func (m *RegistryDefault) LoginStrategies() login.Strategies {
 	return m.loginStrategies
 }
 
+func (m *RegistryDefault) AllLoginStrategies() login.Strategies {
+	var loginStrategies []login.Strategy
+	for _, strategy := range m.selfServiceStrategies() {
+		if s, ok := strategy.(login.Strategy); ok {
+			loginStrategies = append(loginStrategies, s)
+		}
+	}
+	return loginStrategies
+}
+
 func (m *RegistryDefault) VerificationStrategies() verification.Strategies {
 	if len(m.verificationStrategies) == 0 {
 		for _, strategy := range m.selfServiceStrategies() {
diff --git a/driver/registry_default_recovery.go b/driver/registry_default_recovery.go
index 6fcb25dce..a86955dde 100644
--- a/driver/registry_default_recovery.go
+++ b/driver/registry_default_recovery.go
@@ -32,3 +32,13 @@ func (m *RegistryDefault) RecoveryStrategies() recovery.Strategies {
 	}
 	return m.recoveryStrategies
 }
+
+func (m *RegistryDefault) AllRecoveryStrategies() recovery.Strategies {
+	var recoveryStrategies []recovery.Strategy
+	for _, strategy := range m.selfServiceStrategies() {
+		if s, ok := strategy.(recovery.Strategy); ok {
+			recoveryStrategies = append(recoveryStrategies, s)
+		}
+	}
+	return recoveryStrategies
+}
diff --git a/driver/registry_default_settings.go b/driver/registry_default_settings.go
index f1a137fd3..ca3cfa41a 100644
--- a/driver/registry_default_settings.go
+++ b/driver/registry_default_settings.go
@@ -57,3 +57,13 @@ func (m *RegistryDefault) SettingsStrategies() settings.Strategies {
 	}
 	return m.profileStrategies
 }
+
+func (m *RegistryDefault) AllSettingsStrategies() settings.Strategies {
+	var profileStrategies []settings.Strategy
+	for _, strategy := range m.selfServiceStrategies() {
+		if s, ok := strategy.(settings.Strategy); ok {
+			profileStrategies = append(profileStrategies, s)
+		}
+	}
+	return profileStrategies
+}
diff --git a/go.mod b/go.mod
index 3ebd77bfc..61ec1c9db 100644
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	github.com/go-swagger/go-swagger v0.25.0
 	github.com/gobuffalo/fizz v1.13.1-0.20200903094245-046abeb7de46
 	github.com/gobuffalo/httptest v1.0.2
-	github.com/gobuffalo/pop/v5 v5.3.2-0.20210108121026-333700c8729e
+	github.com/gobuffalo/pop/v5 v5.3.2-0.20210128124218-e397a61c1704
 	github.com/gobuffalo/uuid v2.0.5+incompatible
 	github.com/gofrs/uuid v3.2.0+incompatible
 	github.com/golang/gddo v0.0.0-20190904175337-72a348e765d2
@@ -62,12 +62,12 @@ require (
 	github.com/ory/go-convenience v0.1.0
 	github.com/ory/graceful v0.1.1
 	github.com/ory/herodot v0.9.0
-	github.com/ory/jsonschema/v3 v3.0.1
+	github.com/ory/jsonschema/v3 v3.0.2
 	github.com/ory/kratos-client-go v0.0.0-00010101000000-000000000000
 	github.com/ory/kratos/corp v0.0.0-00010101000000-000000000000
 	github.com/ory/mail/v3 v3.0.0
 	github.com/ory/nosurf v1.2.3
-	github.com/ory/x v0.0.174
+	github.com/ory/x v0.0.179
 	github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.4.0
@@ -79,7 +79,7 @@ require (
 	github.com/spf13/cobra v1.0.0
 	github.com/spf13/pflag v1.0.5
 	github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518
-	github.com/stretchr/testify v1.6.1
+	github.com/stretchr/testify v1.7.0
 	github.com/tidwall/gjson v1.3.5
 	github.com/tidwall/sjson v1.0.4
 	github.com/uber/jaeger-lib v2.4.0+incompatible // indirect
diff --git a/go.sum b/go.sum
index b76e7836c..c2c5304f5 100644
--- a/go.sum
+++ b/go.sum
@@ -116,6 +116,8 @@ github.com/cockroachdb/cockroach-go v0.0.0-20190925194419-606b3d062051/go.mod h1
 github.com/cockroachdb/cockroach-go v0.0.0-20200312223839-f565e4789405/go.mod h1:XGLbWH/ujMcbPbhZq52Nv6UrCghb1yGn//133kEsvDk=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/codegangsta/negroni v1.0.0/go.mod h1:v0y3T5G7Y1UlFfyxFn/QLRU4a2EuNau2iZY63YTKWo0=
+github.com/containerd/containerd v1.4.3 h1:ijQT13JedHSHrQGWFcGEwzcNKrAGIiZ+jSD5QQG07SY=
+github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/continuity v0.0.0-20181203112020-004b46473808/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190827140505-75bee3e2ccb6 h1:NmTXa/uVnDyp0TY5MKi197+3HWcnYWfnHGyaFthlnGw=
 github.com/containerd/continuity v0.0.0-20190827140505-75bee3e2ccb6/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -157,6 +159,10 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZm
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
+github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v17.12.0-ce-rc1.0.20201201034508-7d75c1d40d88+incompatible h1:rsPfdypSNWulLrsXo3WiBdlNQpokgBqfWLjEa/aXiBc=
+github.com/docker/docker v17.12.0-ce-rc1.0.20201201034508-7d75c1d40d88+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.3.3 h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
@@ -589,8 +595,8 @@ github.com/gobuffalo/pop/v5 v5.0.11/go.mod h1:mZJHJbA3cy2V18abXYuVop2ldEJ8UZ2DK6
 github.com/gobuffalo/pop/v5 v5.2.0/go.mod h1:Hj586Cr7FoTFNmvzyNdUcajv3r0A+W+bkil4RIX/zKo=
 github.com/gobuffalo/pop/v5 v5.3.1 h1:dJbBPy6e0G0VRjn28md3fk16wpYIBv5iYVQWd0eqmkQ=
 github.com/gobuffalo/pop/v5 v5.3.1/go.mod h1:vcEDhh6cJ3WVENqJDFt/6z7zNb7lLnlN8vj3n5G9rYA=
-github.com/gobuffalo/pop/v5 v5.3.2-0.20210108121026-333700c8729e h1:Z+ubI9KoZMj7cmZVccDwTRic/bw7bymPlSqE+JyCcLc=
-github.com/gobuffalo/pop/v5 v5.3.2-0.20210108121026-333700c8729e/go.mod h1:vcEDhh6cJ3WVENqJDFt/6z7zNb7lLnlN8vj3n5G9rYA=
+github.com/gobuffalo/pop/v5 v5.3.2-0.20210128124218-e397a61c1704 h1:GuJhf1TPqHV8SeO5fgaZTO1xLZPevJqj15y/YQkuXgY=
+github.com/gobuffalo/pop/v5 v5.3.2-0.20210128124218-e397a61c1704/go.mod h1:Ey1hqzDLkWQKNEfsnafaz+3P1h/TrS++W9PmpGsNxvk=
 github.com/gobuffalo/release v1.0.35/go.mod h1:VtHFAKs61vO3wboCec5xr9JPTjYyWYcvaM3lclkc4x4=
 github.com/gobuffalo/release v1.0.38/go.mod h1:VtHFAKs61vO3wboCec5xr9JPTjYyWYcvaM3lclkc4x4=
 github.com/gobuffalo/release v1.0.42/go.mod h1:RPs7EtafH4oylgetOJpGP0yCZZUiO4vqHfTHJjSdpug=
@@ -646,6 +652,7 @@ github.com/gofrs/uuid/v3 v3.1.2/go.mod h1:xPwMqoocQ1L5G6pXX5BcE7N5jlzn2o19oqAKxw
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/gddo v0.0.0-20180828051604-96d2a289f41e/go.mod h1:xEhNfoBDX1hzLm2Nf80qUvZ2sVwoMZ8d6IE2SrsQfh4=
@@ -804,10 +811,14 @@ github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9
 github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
 github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
 github.com/jackc/pgconn v1.3.2/go.mod h1:LvCquS3HbBKwgl7KbX9KyqEIumJAbm1UMcTvGaIf3bM=
+github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
 github.com/jackc/pgconn v1.5.0 h1:oFSOilzIZkyg787M1fEmyMfOUUvwj0daqYMfaWwNL4o=
 github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
+github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
 github.com/jackc/pgconn v1.6.0 h1:8FiBxMxS/Z0eQ9BeE1HhL6pzPL1R5x+ZuQ+T86WgZ4I=
 github.com/jackc/pgconn v1.6.0/go.mod h1:yeseQo4xhQbgyJs2c87RAXOH2i624N0Fh1KSPJya7qo=
+github.com/jackc/pgconn v1.8.0 h1:FmjZ0rOyXTr1wfWs45i4a9vjnjWUAGpMuQLD9OSs+lw=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
 github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2 h1:JVX6jT/XfzNqIjye4717ITLaNwV9mWbJx0dLCpcRzdA=
@@ -824,14 +835,22 @@ github.com/jackc/pgproto3/v2 v2.0.1 h1:Rdjp4NFjwHnEslx2b66FfCI2S0LhO4itac3hXz6WX
 github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.0.2 h1:q1Hsy66zh4vuNsajBUF2PNqfAMMfxU5mk594lPE9vjY=
 github.com/jackc/pgproto3/v2 v2.0.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.0.6 h1:b1105ZGEMFe7aCvrT1Cca3VoVb4ZFMaFJLJcg/3zD+8=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8 h1:Q3tB+ExeflWUW7AFcAhXqk40s9mnNYLk1nOkKNZ5GnU=
 github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
 github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
 github.com/jackc/pgtype v1.3.0 h1:l8JvKrby3RI7Kg3bYEeU9TA4vqC38QDpFCfcrC7KuN0=
 github.com/jackc/pgtype v1.3.0/go.mod h1:b0JqxHvPmljG+HQ5IsvQ0yqeSi4nGcDTVjFoiLDb0Ik=
+github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
+github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
+github.com/jackc/pgtype v1.6.2 h1:b3pDeuhbbzBYcg5kwNmNDun4pFUD/0AAr1kLXZLeNt8=
+github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
 github.com/jackc/pgx v3.2.0+incompatible h1:0Vihzu20St42/UDsvZGdNE6jak7oi/UOeMzwMPHkgFY=
 github.com/jackc/pgx v3.2.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
 github.com/jackc/pgx v3.6.2+incompatible h1:2zP5OD7kiyR3xzRYMhOcXVvkDZsImVXfj+yIyTQf3/o=
@@ -840,11 +859,18 @@ github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.4.1/go.mod h1:6iSW+JznC0YT+SgBn7rNxoEBsBgSmnC5FwyCekOGUiE=
+github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
 github.com/jackc/pgx/v4 v4.6.0 h1:Fh0O9GdlG4gYpjpwOqjdEodJUQM9jzN3Hdv7PN0xmm0=
 github.com/jackc/pgx/v4 v4.6.0/go.mod h1:vPh43ZzxijXUVJ+t/EmXBtFmbFVO72cuneCT9oAlxAg=
+github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
+github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
+github.com/jackc/pgx/v4 v4.10.1 h1:/6Q3ye4myIj6AaplUm+eRcz4OhK9HAvFf4ePsG40LJY=
+github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
@@ -1042,6 +1068,8 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/monoculum/formam v0.0.0-20180901015400-4e68be1d79ba/go.mod h1:RKgILGEJq24YyJ2ban8EO0RUVSJlF1pGsEvoLEACr/Q=
 github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/moul/http2curl v0.0.0-20170919181001-9ac6cf4d929b/go.mod h1:8UbvGypXm98wA/IqH45anm5Y2Z6ep6O31QGOAZ3H0fQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nicksnyder/go-i18n v1.10.0/go.mod h1:HrK7VCrbOvQoUAQ7Vpy7i87N7JZZZ7R2xBGjv0j365Q=
@@ -1115,6 +1143,8 @@ github.com/ory/herodot v0.9.0 h1:p/V+68/5CWmqEmbSVaLusDBECMt9xJjLtklqU/O63HM=
 github.com/ory/herodot v0.9.0/go.mod h1:GYF7mp8/WFRYDYJBR989lipjgx3NTjjdVdUC+hpB8mc=
 github.com/ory/jsonschema/v3 v3.0.1 h1:xzV7w2rt/Qn+jvh71joIXNKKOCqqNyTlaIxdxU0IQJc=
 github.com/ory/jsonschema/v3 v3.0.1/go.mod h1:jgLHekkFk0uiGdEWGleC+tOm6JSSP8cbf17PnBuGXlw=
+github.com/ory/jsonschema/v3 v3.0.2 h1:1yLrKKG8I9I0DrRtZ8lWTOY7cpDssVa3tPmNUPbTfa4=
+github.com/ory/jsonschema/v3 v3.0.2/go.mod h1:BPH8eu7Ws2kxeu4NRA0Pqrm15+fOJDPfQxb55v2sRXA=
 github.com/ory/mail v2.3.1+incompatible h1:vHntHDHtQXamt2T+iwTTlCoBkDvILUeujE9Ocwe9md4=
 github.com/ory/mail v2.3.1+incompatible/go.mod h1:87D9/1gB6ewElQoN0lXJ0ayfqcj3cW3qCTXh+5E9mfU=
 github.com/ory/mail/v3 v3.0.0 h1:8LFMRj473vGahFD/ntiotWEd4S80FKYFtiZTDfOQ+sM=
@@ -1131,8 +1161,8 @@ github.com/ory/x v0.0.93/go.mod h1:lfcTaGXpTZs7IEQAW00r9EtTCOxD//SiP5uWtNiz31g=
 github.com/ory/x v0.0.110/go.mod h1:DJfkE3GdakhshNhw4zlKoRaL/ozg/lcTahA9OCih2BE=
 github.com/ory/x v0.0.127/go.mod h1:FwUujfFuCj5d+xgLn4fGMYPnzriR5bdAIulFXMtnK0M=
 github.com/ory/x v0.0.166/go.mod h1:gT/3K0mSFaPllJgoFrvKYIBYI5W1Nz5RxQTJCGrIwDY=
-github.com/ory/x v0.0.174 h1:HFI1tx84FkBYCiv0EoVkkC7AHzu+lwiNKtxFXqe+Cb0=
-github.com/ory/x v0.0.174/go.mod h1:8d8Mlj2/ho+80yGjhFOVgbRWdm4loEwon622JtsdZyo=
+github.com/ory/x v0.0.179 h1:ewzGC1n2uWEmGRDVzYYzHsbdHrxNtkCwGjbkpZeeNKI=
+github.com/ory/x v0.0.179/go.mod h1:SGETCUk1DgQC30bb7y4hjhkKGQ1x0YOsldrmGmy6MNc=
 github.com/parnurzeal/gorequest v0.2.15/go.mod h1:3Kh2QUMJoqw3icWAecsyzkpY7UzRfDhbRdTjtNwNiUE=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c h1:Lgl0gzECD8GnQ5QCWA8o6BtfL6mDH5rQgM4/fX3avOs=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -1236,6 +1266,8 @@ github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24 h1:pntxY8Ary0t43dCZ5dqY4YTJCObLY1kIXl0uzMv+7DE=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc h1:jUIKcSPO9MoMJBbEoyE/RJoE8vz7Mb8AjvifMMwSyvY=
+github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e h1:MZM7FHLqUHYI0Y/mQAt3d2aYa0SiNms/hFqC9qJYolM=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
@@ -1325,6 +1357,8 @@ github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/subosito/gotenv v1.1.1/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
@@ -1401,7 +1435,11 @@ go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.1 h1:rsqfU5vBkVknbhUGbAUwQKR2H4ItV8tjJ+6kJX4cxHM=
 go.uber.org/atomic v1.5.1/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.6.0 h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
 go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
@@ -1678,6 +1716,7 @@ golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191004055002-72853e10c5a3/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191224055732-dd894d0a8a40/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
diff --git a/identity/pool.go b/identity/pool.go
index 71e967008..8fc443792 100644
--- a/identity/pool.go
+++ b/identity/pool.go
@@ -86,10 +86,9 @@ type (
 	}
 )
 
-func TestPool(conf *config.Config, p interface {
+func TestPool(ctx context.Context, conf *config.Config, p interface {
 	PrivilegedPool
 }) func(t *testing.T) {
-	ctx := context.Background()
 	return func(t *testing.T) {
 		exampleServerURL := urlx.ParseOrPanic("http://example.com")
 		conf.MustSet(config.ViperKeyPublicBaseURL, exampleServerURL.String())
diff --git a/internal/httpclient/models/complete_self_service_login_flow_with_password_method.go b/internal/httpclient/models/complete_self_service_login_flow_with_password_method.go
index 8342b519a..f792d9619 100644
--- a/internal/httpclient/models/complete_self_service_login_flow_with_password_method.go
+++ b/internal/httpclient/models/complete_self_service_login_flow_with_password_method.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod complete self service login flow with password method
+// CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod CompleteSelfServiceLoginFlowWithPasswordMethod complete self service login flow with password method
 //
 // swagger:model CompleteSelfServiceLoginFlowWithPasswordMethod
 type CompleteSelfServiceLoginFlowWithPasswordMethod struct {
diff --git a/internal/httpclient/models/complete_self_service_recovery_flow_with_link_method.go b/internal/httpclient/models/complete_self_service_recovery_flow_with_link_method.go
index 2dd7a8a6a..e8b64af36 100644
--- a/internal/httpclient/models/complete_self_service_recovery_flow_with_link_method.go
+++ b/internal/httpclient/models/complete_self_service_recovery_flow_with_link_method.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod complete self service recovery flow with link method
+// CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod CompleteSelfServiceRecoveryFlowWithLinkMethod complete self service recovery flow with link method
 //
 // swagger:model completeSelfServiceRecoveryFlowWithLinkMethod
 type CompleteSelfServiceRecoveryFlowWithLinkMethod struct {
diff --git a/internal/httpclient/models/complete_self_service_settings_flow_with_password_method.go b/internal/httpclient/models/complete_self_service_settings_flow_with_password_method.go
index 07bf3fd80..aac5c8c34 100644
--- a/internal/httpclient/models/complete_self_service_settings_flow_with_password_method.go
+++ b/internal/httpclient/models/complete_self_service_settings_flow_with_password_method.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod complete self service settings flow with password method
+// CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod CompleteSelfServiceSettingsFlowWithPasswordMethod complete self service settings flow with password method
 //
 // swagger:model CompleteSelfServiceSettingsFlowWithPasswordMethod
 type CompleteSelfServiceSettingsFlowWithPasswordMethod struct {
diff --git a/internal/httpclient/models/complete_self_service_verification_flow_with_link_method.go b/internal/httpclient/models/complete_self_service_verification_flow_with_link_method.go
index 956f051e8..c67e1fa5d 100644
--- a/internal/httpclient/models/complete_self_service_verification_flow_with_link_method.go
+++ b/internal/httpclient/models/complete_self_service_verification_flow_with_link_method.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod complete self service verification flow with link method
+// CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod CompleteSelfServiceVerificationFlowWithLinkMethod complete self service verification flow with link method
 //
 // swagger:model completeSelfServiceVerificationFlowWithLinkMethod
 type CompleteSelfServiceVerificationFlowWithLinkMethod struct {
diff --git a/internal/httpclient/models/create_identity.go b/internal/httpclient/models/create_identity.go
index efdb660d7..d0fd24523 100644
--- a/internal/httpclient/models/create_identity.go
+++ b/internal/httpclient/models/create_identity.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity create identity
+// CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity CreateIdentity create identity
 //
 // swagger:model CreateIdentity
 type CreateIdentity struct {
diff --git a/internal/httpclient/models/create_recovery_link.go b/internal/httpclient/models/create_recovery_link.go
index 59444751b..c7f1ea6ed 100644
--- a/internal/httpclient/models/create_recovery_link.go
+++ b/internal/httpclient/models/create_recovery_link.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink create recovery link
+// CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink CreateRecoveryLink create recovery link
 //
 // swagger:model CreateRecoveryLink
 type CreateRecoveryLink struct {
diff --git a/internal/httpclient/models/error_container.go b/internal/httpclient/models/error_container.go
index a1faff304..7c1422042 100644
--- a/internal/httpclient/models/error_container.go
+++ b/internal/httpclient/models/error_container.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// ErrorContainer ErrorContainer ErrorContainer error container
+// ErrorContainer ErrorContainer ErrorContainer ErrorContainer error container
 //
 // swagger:model errorContainer
 type ErrorContainer struct {
diff --git a/internal/httpclient/models/form_field.go b/internal/httpclient/models/form_field.go
index 02ae39aff..fe2c651f1 100644
--- a/internal/httpclient/models/form_field.go
+++ b/internal/httpclient/models/form_field.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// FormField FormField FormField Field represents a HTML Form Field
+// FormField FormField FormField FormField Field represents a HTML Form Field
 //
 // swagger:model formField
 type FormField struct {
diff --git a/internal/httpclient/models/generic_error_payload.go b/internal/httpclient/models/generic_error_payload.go
index a63a5a221..84a516921 100644
--- a/internal/httpclient/models/generic_error_payload.go
+++ b/internal/httpclient/models/generic_error_payload.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload
+// GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload GenericErrorPayload generic error payload
 //
 // swagger:model genericErrorPayload
 type GenericErrorPayload struct {
diff --git a/internal/httpclient/models/health_status.go b/internal/httpclient/models/health_status.go
index 5525dbc20..a2057e101 100644
--- a/internal/httpclient/models/health_status.go
+++ b/internal/httpclient/models/health_status.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// HealthStatus health status
+// HealthStatus HealthStatus health status
 //
 // swagger:model healthStatus
 type HealthStatus struct {
diff --git a/internal/httpclient/models/id.go b/internal/httpclient/models/id.go
index 16268f926..a275a2dc5 100644
--- a/internal/httpclient/models/id.go
+++ b/internal/httpclient/models/id.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-// ID ID ID ID ID ID ID ID ID ID ID
+// ID ID ID ID ID ID ID ID ID ID ID ID
 //
 // swagger:model ID
 type ID int64
diff --git a/internal/httpclient/models/identity.go b/internal/httpclient/models/identity.go
index 2dc25e37c..4b9113e52 100644
--- a/internal/httpclient/models/identity.go
+++ b/internal/httpclient/models/identity.go
@@ -15,7 +15,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity
+// Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity Identity identity
 //
 // swagger:model Identity
 type Identity struct {
diff --git a/internal/httpclient/models/login_flow.go b/internal/httpclient/models/login_flow.go
index 3cfb04fdf..1565d60ec 100644
--- a/internal/httpclient/models/login_flow.go
+++ b/internal/httpclient/models/login_flow.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// LoginFlow LoginFlow Login Flow
+// LoginFlow Login Flow
 //
 // This object represents a login flow. A login flow is initiated at the "Initiate Login API / Browser Flow"
 // endpoint by a client.
diff --git a/internal/httpclient/models/login_flow_method.go b/internal/httpclient/models/login_flow_method.go
index 7c5b77cfe..6e38e1a21 100644
--- a/internal/httpclient/models/login_flow_method.go
+++ b/internal/httpclient/models/login_flow_method.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// LoginFlowMethod LoginFlowMethod login flow method
+// LoginFlowMethod login flow method
 //
 // swagger:model loginFlowMethod
 type LoginFlowMethod struct {
diff --git a/internal/httpclient/models/login_flow_method_config.go b/internal/httpclient/models/login_flow_method_config.go
index 123b0890d..2f1378f53 100644
--- a/internal/httpclient/models/login_flow_method_config.go
+++ b/internal/httpclient/models/login_flow_method_config.go
@@ -15,7 +15,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// LoginFlowMethodConfig LoginFlowMethodConfig login flow method config
+// LoginFlowMethodConfig LoginFlowMethodConfig LoginFlowMethodConfig login flow method config
 //
 // swagger:model loginFlowMethodConfig
 type LoginFlowMethodConfig struct {
diff --git a/internal/httpclient/models/login_via_api_response.go b/internal/httpclient/models/login_via_api_response.go
index 888761de1..47fee7118 100644
--- a/internal/httpclient/models/login_via_api_response.go
+++ b/internal/httpclient/models/login_via_api_response.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// LoginViaAPIResponse LoginViaAPIResponse The Response for Login Flows via API
+// LoginViaAPIResponse The Response for Login Flows via API
 //
 // swagger:model loginViaApiResponse
 type LoginViaAPIResponse struct {
diff --git a/internal/httpclient/models/message.go b/internal/httpclient/models/message.go
index 5e122d423..9b1595de3 100644
--- a/internal/httpclient/models/message.go
+++ b/internal/httpclient/models/message.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// Message Message Message Message Message Message Message Message Message Message message
+// Message Message Message Message Message Message Message Message Message Message Message message
 //
 // swagger:model Message
 type Message struct {
diff --git a/internal/httpclient/models/messages.go b/internal/httpclient/models/messages.go
index dc2fb841d..9896642f8 100644
--- a/internal/httpclient/models/messages.go
+++ b/internal/httpclient/models/messages.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages
+// Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages Messages messages
 //
 // swagger:model Messages
 type Messages []*Message
diff --git a/internal/httpclient/models/recovery_address.go b/internal/httpclient/models/recovery_address.go
index 3756b5dc6..da1b879e5 100644
--- a/internal/httpclient/models/recovery_address.go
+++ b/internal/httpclient/models/recovery_address.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress recovery address
+// RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress RecoveryAddress recovery address
 //
 // swagger:model RecoveryAddress
 type RecoveryAddress struct {
diff --git a/internal/httpclient/models/recovery_address_type.go b/internal/httpclient/models/recovery_address_type.go
index c066f6a7b..737ad382d 100644
--- a/internal/httpclient/models/recovery_address_type.go
+++ b/internal/httpclient/models/recovery_address_type.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-// RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type
+// RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType RecoveryAddressType recovery address type
 //
 // swagger:model RecoveryAddressType
 type RecoveryAddressType string
diff --git a/internal/httpclient/models/recovery_flow.go b/internal/httpclient/models/recovery_flow.go
index 9dfce340f..6cee1d040 100644
--- a/internal/httpclient/models/recovery_flow.go
+++ b/internal/httpclient/models/recovery_flow.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RecoveryFlow RecoveryFlow A Recovery Flow
+// RecoveryFlow A Recovery Flow
 //
 // This request is used when an identity wants to recover their account.
 //
diff --git a/internal/httpclient/models/recovery_flow_method.go b/internal/httpclient/models/recovery_flow_method.go
index 112cbd4af..15fa7184d 100644
--- a/internal/httpclient/models/recovery_flow_method.go
+++ b/internal/httpclient/models/recovery_flow_method.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RecoveryFlowMethod recovery flow method
+// RecoveryFlowMethod RecoveryFlowMethod recovery flow method
 //
 // swagger:model recoveryFlowMethod
 type RecoveryFlowMethod struct {
diff --git a/internal/httpclient/models/recovery_flow_method_config.go b/internal/httpclient/models/recovery_flow_method_config.go
index e555cbb07..a12f2cd7f 100644
--- a/internal/httpclient/models/recovery_flow_method_config.go
+++ b/internal/httpclient/models/recovery_flow_method_config.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig RecoveryFlowMethodConfig recovery flow method config
+// RecoveryFlowMethodConfig recovery flow method config
 //
 // swagger:model recoveryFlowMethodConfig
 type RecoveryFlowMethodConfig struct {
diff --git a/internal/httpclient/models/recovery_link.go b/internal/httpclient/models/recovery_link.go
index 0b45e211f..f8e20f951 100644
--- a/internal/httpclient/models/recovery_link.go
+++ b/internal/httpclient/models/recovery_link.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RecoveryLink recovery link
+// RecoveryLink RecoveryLink recovery link
 //
 // swagger:model recoveryLink
 type RecoveryLink struct {
@@ -23,6 +23,7 @@ type RecoveryLink struct {
 	//
 	// The timestamp when the recovery link expires.
 	// Format: date-time
+	// Format: date-time
 	ExpiresAt strfmt.DateTime `json:"expires_at,omitempty"`
 
 	// Recovery Link
diff --git a/internal/httpclient/models/registration_flow.go b/internal/httpclient/models/registration_flow.go
index a05a2a927..4fcc935af 100644
--- a/internal/httpclient/models/registration_flow.go
+++ b/internal/httpclient/models/registration_flow.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RegistrationFlow RegistrationFlow RegistrationFlow registration flow
+// RegistrationFlow RegistrationFlow RegistrationFlow RegistrationFlow registration flow
 //
 // swagger:model registrationFlow
 type RegistrationFlow struct {
diff --git a/internal/httpclient/models/registration_flow_method_config.go b/internal/httpclient/models/registration_flow_method_config.go
index 393b7ba72..2f40bd065 100644
--- a/internal/httpclient/models/registration_flow_method_config.go
+++ b/internal/httpclient/models/registration_flow_method_config.go
@@ -15,7 +15,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RegistrationFlowMethodConfig registration flow method config
+// RegistrationFlowMethodConfig RegistrationFlowMethodConfig registration flow method config
 //
 // swagger:model registrationFlowMethodConfig
 type RegistrationFlowMethodConfig struct {
diff --git a/internal/httpclient/models/revoke_session.go b/internal/httpclient/models/revoke_session.go
index e7b183a54..c88f1f912 100644
--- a/internal/httpclient/models/revoke_session.go
+++ b/internal/httpclient/models/revoke_session.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession revoke session
+// RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession RevokeSession revoke session
 //
 // swagger:model revokeSession
 type RevokeSession struct {
diff --git a/internal/httpclient/models/session.go b/internal/httpclient/models/session.go
index 632ac3d5c..2054749b9 100644
--- a/internal/httpclient/models/session.go
+++ b/internal/httpclient/models/session.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// Session Session session
+// Session session
 //
 // swagger:model session
 type Session struct {
diff --git a/internal/httpclient/models/settings_flow.go b/internal/httpclient/models/settings_flow.go
index 22f6e0007..814a66d99 100644
--- a/internal/httpclient/models/settings_flow.go
+++ b/internal/httpclient/models/settings_flow.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// SettingsFlow Flow represents a Settings Flow
+// SettingsFlow SettingsFlow Flow represents a Settings Flow
 //
 // This flow is used when an identity wants to update settings
 // (e.g. profile data, passwords, ...) in a selfservice manner.
diff --git a/internal/httpclient/models/settings_flow_method_config.go b/internal/httpclient/models/settings_flow_method_config.go
index 5abf3d4f1..563000830 100644
--- a/internal/httpclient/models/settings_flow_method_config.go
+++ b/internal/httpclient/models/settings_flow_method_config.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// SettingsFlowMethodConfig settings flow method config
+// SettingsFlowMethodConfig SettingsFlowMethodConfig settings flow method config
 //
 // swagger:model settingsFlowMethodConfig
 type SettingsFlowMethodConfig struct {
diff --git a/internal/httpclient/models/settings_via_api_response.go b/internal/httpclient/models/settings_via_api_response.go
index 9ff008d7a..4bd2ecb0c 100644
--- a/internal/httpclient/models/settings_via_api_response.go
+++ b/internal/httpclient/models/settings_via_api_response.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// SettingsViaAPIResponse SettingsViaAPIResponse The Response for Settings Flows via API
+// SettingsViaAPIResponse SettingsViaAPIResponse SettingsViaAPIResponse The Response for Settings Flows via API
 //
 // swagger:model settingsViaApiResponse
 type SettingsViaAPIResponse struct {
diff --git a/internal/httpclient/models/state.go b/internal/httpclient/models/state.go
index b1ae09e9a..b12eafe69 100644
--- a/internal/httpclient/models/state.go
+++ b/internal/httpclient/models/state.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-// State State State State State State State State State State state
+// State State State State State State State State State State State state
 //
 // swagger:model State
 type State string
diff --git a/internal/httpclient/models/traits.go b/internal/httpclient/models/traits.go
index 9db2f9b4a..a251ecda5 100644
--- a/internal/httpclient/models/traits.go
+++ b/internal/httpclient/models/traits.go
@@ -5,7 +5,7 @@ package models
 // This file was generated by the swagger tool.
 // Editing this file might prove futile when you re-run the swagger generate command
 
-// Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits
+// Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits Traits traits
 //
 // swagger:model Traits
 type Traits interface{}
diff --git a/internal/httpclient/models/update_identity.go b/internal/httpclient/models/update_identity.go
index 96178686b..759efa4da 100644
--- a/internal/httpclient/models/update_identity.go
+++ b/internal/httpclient/models/update_identity.go
@@ -13,7 +13,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity update identity
+// UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity UpdateIdentity update identity
 //
 // swagger:model UpdateIdentity
 type UpdateIdentity struct {
diff --git a/internal/httpclient/models/verifiable_address.go b/internal/httpclient/models/verifiable_address.go
index 539043d71..fc908fec5 100644
--- a/internal/httpclient/models/verifiable_address.go
+++ b/internal/httpclient/models/verifiable_address.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress verifiable address
+// VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress VerifiableAddress verifiable address
 //
 // swagger:model VerifiableAddress
 type VerifiableAddress struct {
diff --git a/internal/httpclient/models/verifiable_address_status.go b/internal/httpclient/models/verifiable_address_status.go
index 0eab3ee3f..c84495481 100644
--- a/internal/httpclient/models/verifiable_address_status.go
+++ b/internal/httpclient/models/verifiable_address_status.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-// VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status
+// VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus VerifiableAddressStatus verifiable address status
 //
 // swagger:model VerifiableAddressStatus
 type VerifiableAddressStatus string
diff --git a/internal/httpclient/models/verifiable_address_type.go b/internal/httpclient/models/verifiable_address_type.go
index c21ee8ac7..518abb782 100644
--- a/internal/httpclient/models/verifiable_address_type.go
+++ b/internal/httpclient/models/verifiable_address_type.go
@@ -11,7 +11,7 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-// VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type
+// VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType VerifiableAddressType verifiable address type
 //
 // swagger:model VerifiableAddressType
 type VerifiableAddressType string
diff --git a/internal/httpclient/models/verification_flow.go b/internal/httpclient/models/verification_flow.go
index 1980efb71..f04976eb4 100644
--- a/internal/httpclient/models/verification_flow.go
+++ b/internal/httpclient/models/verification_flow.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// VerificationFlow A Verification Flow
+// VerificationFlow VerificationFlow A Verification Flow
 //
 // Used to verify an out-of-band communication
 // channel such as an email address or a phone number.
@@ -31,6 +31,7 @@ type VerificationFlow struct {
 	// ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address,
 	// a new request has to be initiated.
 	// Format: date-time
+	// Format: date-time
 	ExpiresAt strfmt.DateTime `json:"expires_at,omitempty"`
 
 	// id
@@ -39,6 +40,7 @@ type VerificationFlow struct {
 
 	// IssuedAt is the time (UTC) when the request occurred.
 	// Format: date-time
+	// Format: date-time
 	IssuedAt strfmt.DateTime `json:"issued_at,omitempty"`
 
 	// messages
diff --git a/internal/httpclient/models/verification_flow_method_config.go b/internal/httpclient/models/verification_flow_method_config.go
index 03aa9cc9f..00363f302 100644
--- a/internal/httpclient/models/verification_flow_method_config.go
+++ b/internal/httpclient/models/verification_flow_method_config.go
@@ -14,7 +14,7 @@ import (
 	"github.com/go-openapi/validate"
 )
 
-// VerificationFlowMethodConfig VerificationFlowMethodConfig verification flow method config
+// VerificationFlowMethodConfig verification flow method config
 //
 // swagger:model verificationFlowMethodConfig
 type VerificationFlowMethodConfig struct {
diff --git a/internal/httpclient/models/version.go b/internal/httpclient/models/version.go
index 14a1bf599..3f700bb2d 100644
--- a/internal/httpclient/models/version.go
+++ b/internal/httpclient/models/version.go
@@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/swag"
 )
 
-// Version Version Version Version Version version
+// Version Version Version Version Version Version version
 //
 // swagger:model version
 type Version struct {
diff --git a/persistence/sql/persister_courier.go b/persistence/sql/persister_courier.go
index 458cabc33..244b98f31 100644
--- a/persistence/sql/persister_courier.go
+++ b/persistence/sql/persister_courier.go
@@ -3,10 +3,14 @@ package sql
 import (
 	"context"
 	"database/sql"
+	"fmt"
 
+	"github.com/gobuffalo/pop/v5"
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 
+	"github.com/ory/kratos/corp"
+
 	"github.com/ory/x/sqlcon"
 
 	"github.com/ory/kratos/courier"
@@ -21,10 +25,18 @@ func (p *Persister) AddMessage(ctx context.Context, m *courier.Message) error {
 
 func (p *Persister) NextMessages(ctx context.Context, limit uint8) ([]courier.Message, error) {
 	var m []courier.Message
-	if err := p.GetConnection(ctx).
-		Eager().
-		Where("status != ?", courier.MessageStatusSent).
-		Order("created_at ASC").Limit(int(limit)).All(&m); err != nil {
+	if err := p.Transaction(ctx, func(ctx context.Context, tx *pop.Connection) error {
+		if err := tx.
+			Eager().
+			Where("status = ?", courier.MessageStatusQueued).
+			Order("created_at ASC").Limit(int(limit)).All(&m); err != nil {
+			return err
+		}
+		for i := range m {
+			m[i].Status = courier.MessageStatusProcessing
+		}
+		return tx.UpdateColumns(&m, "status")
+	}); err != nil {
 		if errors.Cause(err) == sql.ErrNoRows {
 			return nil, errors.WithStack(courier.ErrQueueEmpty)
 		}
@@ -42,7 +54,7 @@ func (p *Persister) LatestQueuedMessage(ctx context.Context) (*courier.Message,
 	var m courier.Message
 	if err := p.GetConnection(ctx).
 		Eager().
-		Where("status != ?", courier.MessageStatusSent).
+		Where("status = ?", courier.MessageStatusQueued).
 		Order("created_at DESC").First(&m); err != nil {
 		if errors.Cause(err) == sql.ErrNoRows {
 			return nil, errors.WithStack(courier.ErrQueueEmpty)
@@ -54,7 +66,11 @@ func (p *Persister) LatestQueuedMessage(ctx context.Context) (*courier.Message,
 }
 
 func (p *Persister) SetMessageStatus(ctx context.Context, id uuid.UUID, ms courier.MessageStatus) error {
-	count, err := p.GetConnection(ctx).RawQuery("UPDATE courier_messages SET status = ? WHERE id = ?", ms, id).ExecWithCount()
+	count, err := p.GetConnection(ctx).RawQuery(
+		fmt.Sprintf(
+			"UPDATE %s SET status = ? WHERE id = ?",
+			corp.ContextualizeTableName(ctx, "courier_messages"),
+		), ms, id).ExecWithCount()
 	if err != nil {
 		return sqlcon.HandleError(err)
 	}
diff --git a/persistence/sql/persister_errorx.go b/persistence/sql/persister_errorx.go
index 03fd04651..eb85be179 100644
--- a/persistence/sql/persister_errorx.go
+++ b/persistence/sql/persister_errorx.go
@@ -4,8 +4,11 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"time"
 
+	"github.com/ory/kratos/corp"
+
 	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 
@@ -44,7 +47,7 @@ func (p *Persister) Read(ctx context.Context, id uuid.UUID) (*errorx.ErrorContai
 		return nil, sqlcon.HandleError(err)
 	}
 
-	if err := p.GetConnection(ctx).RawQuery("UPDATE selfservice_errors SET was_seen = true, seen_at = ? WHERE id = ?", time.Now().UTC(), id).Exec(); err != nil {
+	if err := p.GetConnection(ctx).RawQuery(fmt.Sprintf("UPDATE %s SET was_seen = true, seen_at = ? WHERE id = ?", corp.ContextualizeTableName(ctx, "selfservice_errors")), time.Now().UTC(), id).Exec(); err != nil {
 		return nil, sqlcon.HandleError(err)
 	}
 
@@ -53,9 +56,9 @@ func (p *Persister) Read(ctx context.Context, id uuid.UUID) (*errorx.ErrorContai
 
 func (p *Persister) Clear(ctx context.Context, olderThan time.Duration, force bool) (err error) {
 	if force {
-		err = p.GetConnection(ctx).RawQuery("DELETE FROM selfservice_errors WHERE seen_at < ? AND seen_at IS NOT NULL", olderThan).Exec()
+		err = p.GetConnection(ctx).RawQuery(fmt.Sprintf("DELETE FROM %s WHERE seen_at < ? AND seen_at IS NOT NULL", corp.ContextualizeTableName(ctx, "selfservice_errors")), olderThan).Exec()
 	} else {
-		err = p.GetConnection(ctx).RawQuery("DELETE FROM selfservice_errors WHERE was_seen=true AND seen_at < ? AND seen_at IS NOT NULL", time.Now().UTC().Add(-olderThan)).Exec()
+		err = p.GetConnection(ctx).RawQuery(fmt.Sprintf("DELETE FROM %s WHERE was_seen=true AND seen_at < ? AND seen_at IS NOT NULL", corp.ContextualizeTableName(ctx, "selfservice_errors")), time.Now().UTC().Add(-olderThan)).Exec()
 	}
 
 	return sqlcon.HandleError(err)
diff --git a/persistence/sql/persister_identity.go b/persistence/sql/persister_identity.go
index 3dd5be6ce..5d03c9b80 100644
--- a/persistence/sql/persister_identity.go
+++ b/persistence/sql/persister_identity.go
@@ -7,6 +7,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ory/kratos/corp"
+
 	"github.com/ory/jsonschema/v3"
 	"github.com/ory/x/sqlxx"
 
@@ -59,13 +61,17 @@ func (p *Persister) FindByCredentialsIdentifier(ctx context.Context, ct identity
 		match = strings.ToLower(match)
 	}
 
-	if err := p.GetConnection(ctx).RawQuery(`SELECT
+	if err := p.GetConnection(ctx).RawQuery(fmt.Sprintf(`SELECT
     ic.identity_id
-FROM identity_credentials ic
-         INNER JOIN identity_credential_types ict on ic.identity_credential_type_id = ict.id
-         INNER JOIN identity_credential_identifiers ici on ic.id = ici.identity_credential_id
+FROM %s ic
+         INNER JOIN %s ict on ic.identity_credential_type_id = ict.id
+         INNER JOIN %s ici on ic.id = ici.identity_credential_id
 WHERE ici.identifier = ?
-  AND ict.name = ?`, match, ct).First(&find); err != nil {
+  AND ict.name = ?`,
+		corp.ContextualizeTableName(ctx, "identity_credentials"),
+		corp.ContextualizeTableName(ctx, "identity_credential_types"),
+		corp.ContextualizeTableName(ctx, "identity_credential_identifiers"),
+	), match, ct).First(&find); err != nil {
 		if errors.Cause(err) == sql.ErrNoRows {
 			return nil, nil, herodot.ErrNotFound.WithTrace(err).WithReasonf(`No identity matching credentials identifier "%s" could be found.`, match)
 		}
diff --git a/persistence/sql/persister_session.go b/persistence/sql/persister_session.go
index e07197370..de802a8ab 100644
--- a/persistence/sql/persister_session.go
+++ b/persistence/sql/persister_session.go
@@ -2,6 +2,9 @@ package sql
 
 import (
 	"context"
+	"fmt"
+
+	"github.com/ory/kratos/corp"
 
 	"github.com/gofrs/uuid"
 
@@ -37,7 +40,10 @@ func (p *Persister) DeleteSession(ctx context.Context, sid uuid.UUID) error {
 }
 
 func (p *Persister) DeleteSessionsByIdentity(ctx context.Context, identityID uuid.UUID) error {
-	if err := p.GetConnection(ctx).RawQuery("DELETE FROM sessions WHERE identity_id = ?", identityID).Exec(); err != nil {
+	if err := p.GetConnection(ctx).RawQuery(fmt.Sprintf(
+		"DELETE FROM %s WHERE identity_id = ?",
+		corp.ContextualizeTableName(ctx, "sessions"),
+	), identityID).Exec(); err != nil {
 		return sqlcon.HandleError(err)
 	}
 	return nil
@@ -60,14 +66,20 @@ func (p *Persister) GetSessionByToken(ctx context.Context, token string) (*sessi
 }
 
 func (p *Persister) DeleteSessionByToken(ctx context.Context, token string) error {
-	if err := p.GetConnection(ctx).RawQuery("DELETE FROM sessions WHERE token = ?", token).Exec(); err != nil {
+	if err := p.GetConnection(ctx).RawQuery(fmt.Sprintf(
+		"DELETE FROM %s WHERE token = ?",
+		corp.ContextualizeTableName(ctx, "sessions"),
+	), token).Exec(); err != nil {
 		return sqlcon.HandleError(err)
 	}
 	return nil
 }
 
 func (p *Persister) RevokeSessionByToken(ctx context.Context, token string) error {
-	if err := p.GetConnection(ctx).RawQuery("UPDATE sessions SET active = false WHERE token = ?", token).Exec(); err != nil {
+	if err := p.GetConnection(ctx).RawQuery(fmt.Sprintf(
+		"UPDATE %s SET active = false WHERE token = ?",
+		corp.ContextualizeTableName(ctx, "sessions"),
+	), token).Exec(); err != nil {
 		return sqlcon.HandleError(err)
 	}
 	return nil
diff --git a/schema/schema.go b/schema/schema.go
index d4bc072d9..8d8b1918f 100644
--- a/schema/schema.go
+++ b/schema/schema.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/ory/herodot"
 	"github.com/ory/jsonschema/v3"
+	_ "github.com/ory/jsonschema/v3/base64loader"
 	_ "github.com/ory/jsonschema/v3/fileloader"
 	_ "github.com/ory/jsonschema/v3/httploader"
 	"github.com/ory/kratos/driver/config"
diff --git a/selfservice/errorx/persistence.go b/selfservice/errorx/persistence.go
index 8960bb16a..9f5fdf3ed 100644
--- a/selfservice/errorx/persistence.go
+++ b/selfservice/errorx/persistence.go
@@ -35,15 +35,13 @@ type (
 	}
 )
 
-func TestPersister(p Persister) func(t *testing.T) {
+func TestPersister(ctx context.Context, p Persister) func(t *testing.T) {
 	toJSON := func(t *testing.T, in interface{}) string {
 		out, err := json.Marshal(in)
 		require.NoError(t, err)
 		return string(out)
 	}
 
-	ctx := context.Background()
-
 	return func(t *testing.T) {
 		t.Run("case=not found", func(t *testing.T) {
 			_, err := p.Read(ctx, x.NewUUID())
diff --git a/selfservice/flow/login/persistence.go b/selfservice/flow/login/persistence.go
index 9a1d4eaa6..35b1da67d 100644
--- a/selfservice/flow/login/persistence.go
+++ b/selfservice/flow/login/persistence.go
@@ -28,7 +28,7 @@ type (
 	}
 )
 
-func TestFlowPersister(p FlowPersister) func(t *testing.T) {
+func TestFlowPersister(ctx context.Context, p FlowPersister) func(t *testing.T) {
 	var clearids = func(r *Flow) {
 		r.ID = uuid.UUID{}
 		for k := range r.Methods {
@@ -36,7 +36,6 @@ func TestFlowPersister(p FlowPersister) func(t *testing.T) {
 		}
 	}
 
-	ctx := context.Background()
 	return func(t *testing.T) {
 		t.Run("case=should error when the login flow does not exist", func(t *testing.T) {
 			_, err := p.GetLoginFlow(ctx, x.NewUUID())
diff --git a/selfservice/flow/recovery/persistence.go b/selfservice/flow/recovery/persistence.go
index 514d9b671..7f4b3b294 100644
--- a/selfservice/flow/recovery/persistence.go
+++ b/selfservice/flow/recovery/persistence.go
@@ -28,7 +28,7 @@ type (
 	}
 )
 
-func TestFlowPersister(conf *config.Config, p interface {
+func TestFlowPersister(ctx context.Context, conf *config.Config, p interface {
 	FlowPersister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
@@ -36,7 +36,6 @@ func TestFlowPersister(conf *config.Config, p interface {
 		r.ID = uuid.UUID{}
 	}
 
-	ctx := context.Background()
 	return func(t *testing.T) {
 		conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
 
diff --git a/selfservice/flow/registration/persistence.go b/selfservice/flow/registration/persistence.go
index 55b4ed7b2..a005dc453 100644
--- a/selfservice/flow/registration/persistence.go
+++ b/selfservice/flow/registration/persistence.go
@@ -26,7 +26,7 @@ type FlowPersistenceProvider interface {
 	RegistrationFlowPersister() FlowPersister
 }
 
-func TestFlowPersister(p FlowPersister) func(t *testing.T) {
+func TestFlowPersister(ctx context.Context, p FlowPersister) func(t *testing.T) {
 	var clearids = func(r *Flow) {
 		r.ID = uuid.UUID{}
 		for k := range r.Methods {
@@ -34,7 +34,6 @@ func TestFlowPersister(p FlowPersister) func(t *testing.T) {
 		}
 	}
 
-	ctx := context.Background()
 	return func(t *testing.T) {
 		t.Run("case=should error when the registration flow does not exist", func(t *testing.T) {
 			_, err := p.GetRegistrationFlow(ctx, x.NewUUID())
diff --git a/selfservice/flow/settings/hook.go b/selfservice/flow/settings/hook.go
index a1b37970f..8685721ec 100644
--- a/selfservice/flow/settings/hook.go
+++ b/selfservice/flow/settings/hook.go
@@ -2,11 +2,12 @@ package settings
 
 import (
 	"fmt"
-	"github.com/ory/kratos/schema"
-	"github.com/ory/x/sqlcon"
 	"net/http"
 	"time"
 
+	"github.com/ory/kratos/schema"
+	"github.com/ory/x/sqlcon"
+
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 
diff --git a/selfservice/flow/settings/persistence.go b/selfservice/flow/settings/persistence.go
index 043724c6f..d161fbb44 100644
--- a/selfservice/flow/settings/persistence.go
+++ b/selfservice/flow/settings/persistence.go
@@ -28,7 +28,7 @@ type (
 	}
 )
 
-func TestRequestPersister(conf *config.Config, p interface {
+func TestRequestPersister(ctx context.Context, conf *config.Config, p interface {
 	FlowPersister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
@@ -38,7 +38,6 @@ func TestRequestPersister(conf *config.Config, p interface {
 		r.IdentityID = uuid.UUID{}
 	}
 
-	ctx := context.Background()
 	return func(t *testing.T) {
 		conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
 
diff --git a/selfservice/flow/verification/persistence.go b/selfservice/flow/verification/persistence.go
index 5da9e2686..b752b499d 100644
--- a/selfservice/flow/verification/persistence.go
+++ b/selfservice/flow/verification/persistence.go
@@ -28,7 +28,7 @@ type (
 	}
 )
 
-func TestFlowPersister(conf *config.Config, p interface {
+func TestFlowPersister(ctx context.Context, conf *config.Config, p interface {
 	FlowPersister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
@@ -36,7 +36,6 @@ func TestFlowPersister(conf *config.Config, p interface {
 		r.ID = uuid.UUID{}
 	}
 
-	ctx := context.Background()
 	return func(t *testing.T) {
 		conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
 
diff --git a/selfservice/strategy/handler.go b/selfservice/strategy/handler.go
new file mode 100644
index 000000000..b73f60778
--- /dev/null
+++ b/selfservice/strategy/handler.go
@@ -0,0 +1,25 @@
+package strategy
+
+import (
+	"github.com/julienschmidt/httprouter"
+	"github.com/ory/herodot"
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/x"
+	"net/http"
+)
+
+const EndpointDisabledMessage = "This endpoint was disabled by system administrator. Please check your url or contact the system administrator to enable it."
+
+func IsDisabled(c interface {
+	config.Provider
+	x.WriterProvider
+}, strategy string, wrap httprouter.Handle) httprouter.Handle {
+	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		enabled := c.Config(r.Context()).SelfServiceStrategy(strategy).Enabled
+		if !enabled {
+			c.Writer().WriteError(w, r, herodot.ErrNotFound.WithReason(EndpointDisabledMessage))
+			return
+		}
+		wrap(w, r, ps)
+	}
+}
diff --git a/selfservice/strategy/link/persister_conformity.go b/selfservice/strategy/link/persister_conformity.go
index 68bf5581c..9925f0312 100644
--- a/selfservice/strategy/link/persister_conformity.go
+++ b/selfservice/strategy/link/persister_conformity.go
@@ -19,14 +19,13 @@ import (
 	"github.com/ory/kratos/x"
 )
 
-func TestPersister(conf *config.Config, p interface {
+func TestPersister(ctx context.Context, conf *config.Config, p interface {
 	RecoveryTokenPersister
 	VerificationTokenPersister
 	recovery.FlowPersister
 	verification.FlowPersister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
-	ctx := context.Background()
 	return func(t *testing.T) {
 		conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
 		conf.MustSet(config.ViperKeySecretsDefault, []string{"secret-a", "secret-b"})
diff --git a/selfservice/strategy/link/strategy.go b/selfservice/strategy/link/strategy.go
index d27e8c4d1..81e8337a6 100644
--- a/selfservice/strategy/link/strategy.go
+++ b/selfservice/strategy/link/strategy.go
@@ -1,10 +1,8 @@
 package link
 
 import (
-	"github.com/ory/kratos/driver/config"
-	"github.com/ory/x/decoderx"
-
 	"github.com/ory/kratos/courier"
+	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/errorx"
@@ -14,6 +12,7 @@ import (
 	"github.com/ory/kratos/selfservice/form"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/decoderx"
 )
 
 var _ recovery.Strategy = new(Strategy)
diff --git a/selfservice/strategy/link/strategy_recovery.go b/selfservice/strategy/link/strategy_recovery.go
index d2c8f5c14..c18f231d8 100644
--- a/selfservice/strategy/link/strategy_recovery.go
+++ b/selfservice/strategy/link/strategy_recovery.go
@@ -25,6 +25,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/recovery"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/text"
 	"github.com/ory/kratos/x"
@@ -41,12 +42,16 @@ func (s *Strategy) RecoveryStrategyID() string {
 
 func (s *Strategy) RegisterPublicRecoveryRoutes(public *x.RouterPublic) {
 	redirect := session.RedirectOnAuthenticated(s.d)
-	public.GET(RouteRecovery, s.d.SessionHandler().IsNotAuthenticated(s.handleRecovery, redirect))
-	public.POST(RouteRecovery, s.d.SessionHandler().IsNotAuthenticated(s.handleRecovery, redirect))
+
+	wrappedHandleRecovery := strategy.IsDisabled(s.d, s.RecoveryStrategyID(), s.handleRecovery)
+	public.GET(RouteRecovery, s.d.SessionHandler().IsNotAuthenticated(wrappedHandleRecovery, redirect))
+
+	public.POST(RouteRecovery, s.d.SessionHandler().IsNotAuthenticated(wrappedHandleRecovery, redirect))
 }
 
 func (s *Strategy) RegisterAdminRecoveryRoutes(admin *x.RouterAdmin) {
-	admin.POST(RouteAdminCreateRecoveryLink, s.createRecoveryLink)
+	wrappedCreateRecoveryLink := strategy.IsDisabled(s.d, s.RecoveryStrategyID(), s.createRecoveryLink)
+	admin.POST(RouteAdminCreateRecoveryLink, wrappedCreateRecoveryLink)
 }
 
 func (s *Strategy) PopulateRecoveryMethod(r *http.Request, req *recovery.Flow) error {
diff --git a/selfservice/strategy/oidc/provider_config.go b/selfservice/strategy/oidc/provider_config.go
index 2f68668dc..891078e26 100644
--- a/selfservice/strategy/oidc/provider_config.go
+++ b/selfservice/strategy/oidc/provider_config.go
@@ -24,6 +24,7 @@ type Configuration struct {
 	// - microsoft
 	// - discord
 	// - slack
+	// - facebook
 	Provider string `json:"provider"`
 
 	// ClientID is the application's Client ID.
@@ -102,6 +103,8 @@ func (c ConfigurationCollection) Provider(id string, public *url.URL) (Provider,
 				return NewProviderDiscord(&p, public), nil
 			case addProviderName("slack"):
 				return NewProviderSlack(&p, public), nil
+			case addProviderName("facebook"):
+				return NewProviderFacebook(&p, public), nil
 			}
 			return nil, errors.Errorf("provider type %s is not supported, supported are: %v", p.Provider, providerNames)
 		}
diff --git a/selfservice/strategy/oidc/provider_facebook.go b/selfservice/strategy/oidc/provider_facebook.go
new file mode 100644
index 000000000..bfd7ec471
--- /dev/null
+++ b/selfservice/strategy/oidc/provider_facebook.go
@@ -0,0 +1,110 @@
+package oidc
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/ory/herodot"
+	"github.com/pkg/errors"
+	"golang.org/x/oauth2"
+	"net/http"
+	"net/url"
+)
+
+type ProviderFacebook struct {
+	*ProviderGenericOIDC
+}
+
+func NewProviderFacebook(
+	config *Configuration,
+	public *url.URL,
+) *ProviderFacebook {
+	config.IssuerURL = "https://facebook.com"
+	return &ProviderFacebook{
+		ProviderGenericOIDC: &ProviderGenericOIDC{
+			config: config,
+			public: public,
+		},
+	}
+}
+
+func (g *ProviderFacebook) OAuth2(ctx context.Context) (*oauth2.Config, error) {
+	p, err := g.provider(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	endpoint := p.Endpoint()
+
+	if endpoint.AuthURL == "" {
+		endpoint.AuthURL = "https://facebook.com/dialog/oauth"
+	}
+	if endpoint.TokenURL == "" {
+		endpoint.TokenURL = "https://graph.facebook.com/oauth/access_token"
+	}
+
+	return g.oauth2ConfigFromEndpoint(endpoint), nil
+}
+
+func (g *ProviderFacebook) Claims(ctx context.Context, exchange *oauth2.Token) (*Claims, error) {
+	o, err := g.OAuth2(ctx)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	client := o.Client(ctx, exchange)
+
+	u, err := url.Parse("https://graph.facebook.com/me?fields=id,name,first_name,last_name,middle_name,email,picture,birthday,gender")
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+	req, err := http.NewRequest("GET", u.String(), nil)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+	defer resp.Body.Close()
+
+	var user struct {
+		Id            string `json:"id,omitempty"`
+		Name          string `json:"name,omitempty"`
+		FirstName     string `json:"first_name,omitempty"`
+		LastName      string `json:"last_name,omitempty"`
+		MiddleName    string `json:"middle_name,omitempty"`
+		Email         string `json:"email,omitempty"`
+		EmailVerified bool
+		Picture       struct {
+			Data struct {
+				Url string `json:"url,omitempty"`
+			} `json:"data,omitempty"`
+		} `json:"picture,omitempty"`
+		BirthDay string `json:"birthday,omitempty"`
+		Gender   string `json:"gender,omitempty"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("%s", err))
+	}
+
+	if user.Email != "" {
+		user.EmailVerified = true
+	}
+
+	return &Claims{
+		Issuer:            u.String(),
+		Subject:           user.Id,
+		Name:              user.Name,
+		GivenName:         user.FirstName,
+		FamilyName:        user.LastName,
+		MiddleName:        user.MiddleName,
+		Nickname:          user.Name,
+		PreferredUsername: user.Name,
+		Picture:           user.Picture.Data.Url,
+		Email:             user.Email,
+		EmailVerified:     user.EmailVerified,
+		Gender:            user.Gender,
+		Birthdate:         user.BirthDay,
+	}, nil
+}
diff --git a/selfservice/strategy/oidc/strategy.go b/selfservice/strategy/oidc/strategy.go
index bf2b5819a..553a20c20 100644
--- a/selfservice/strategy/oidc/strategy.go
+++ b/selfservice/strategy/oidc/strategy.go
@@ -32,6 +32,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow/registration"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
 )
@@ -53,6 +54,7 @@ type dependencies interface {
 	x.LoggingProvider
 	x.CookieProvider
 	x.CSRFTokenGeneratorProvider
+	x.WriterProvider
 
 	identity.ValidationProvider
 	identity.PrivilegedPoolProvider
@@ -89,8 +91,8 @@ func isForced(req interface{}) bool {
 	return ok && f.IsForced()
 }
 
-// Strategy implements selfservice.LoginStrategy, selfservice.RegistrationStrategy. It supports both login
-// and registration via OpenID Providers.
+// Strategy implements selfservice.LoginStrategy, selfservice.RegistrationStrategy and selfservice.SettingsStrategy.
+// It supports login, registration and settings via OpenID Providers.
 type Strategy struct {
 	d         dependencies
 	f         *fetcher.Fetcher
@@ -129,16 +131,18 @@ func (s *Strategy) CountActiveCredentials(cc map[identity.CredentialsType]identi
 }
 
 func (s *Strategy) setRoutes(r *x.RouterPublic) {
+	wrappedHandleCallback := strategy.IsDisabled(s.d, s.ID().String(), s.handleCallback)
 	if handle, _, _ := r.Lookup("GET", RouteCallback); handle == nil {
-		r.GET(RouteCallback, s.handleCallback)
+		r.GET(RouteCallback, wrappedHandleCallback)
 	}
 
+	wrappedHandleAuth := strategy.IsDisabled(s.d, s.ID().String(), s.handleAuth)
 	if handle, _, _ := r.Lookup("POST", RouteAuth); handle == nil {
-		r.POST(RouteAuth, s.handleAuth)
+		r.POST(RouteAuth, wrappedHandleAuth)
 	}
 
 	if handle, _, _ := r.Lookup("GET", RouteAuth); handle == nil {
-		r.GET(RouteAuth, s.handleAuth)
+		r.GET(RouteAuth, wrappedHandleAuth)
 	}
 }
 
diff --git a/selfservice/strategy/oidc/strategy_settings.go b/selfservice/strategy/oidc/strategy_settings.go
index d0753efd6..52712a640 100644
--- a/selfservice/strategy/oidc/strategy_settings.go
+++ b/selfservice/strategy/oidc/strategy_settings.go
@@ -20,6 +20,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/x"
 )
 
@@ -34,8 +35,9 @@ var ConnectionExistValidationError = &jsonschema.ValidationError{
 	Message: "can not link unknown or already existing OpenID Connect connection", InstancePtr: "#/"}
 
 func (s *Strategy) RegisterSettingsRoutes(router *x.RouterPublic) {
-	router.POST(SettingsPath, s.completeSettingsFlow)
-	router.GET(SettingsPath, s.completeSettingsFlow)
+	wrappedCompleteSettingsFlow := strategy.IsDisabled(s.d, s.SettingsStrategyID(), s.completeSettingsFlow)
+	router.POST(SettingsPath, wrappedCompleteSettingsFlow)
+	router.GET(SettingsPath, wrappedCompleteSettingsFlow)
 }
 
 func (s *Strategy) SettingsStrategyID() string {
diff --git a/selfservice/strategy/password/login.go b/selfservice/strategy/password/login.go
index f8729bd17..b786be597 100644
--- a/selfservice/strategy/password/login.go
+++ b/selfservice/strategy/password/login.go
@@ -21,6 +21,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/login"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/x"
 )
 
@@ -31,7 +32,8 @@ const (
 func (s *Strategy) RegisterLoginRoutes(r *x.RouterPublic) {
 	s.d.CSRFHandler().IgnorePath(RouteLogin)
 
-	r.POST(RouteLogin, s.handleLogin)
+	wrappedHandleLogin := strategy.IsDisabled(s.d, s.ID().String(), s.handleLogin)
+	r.POST(RouteLogin, wrappedHandleLogin)
 }
 
 func (s *Strategy) handleLoginError(w http.ResponseWriter, r *http.Request, rr *login.Flow, payload *CompleteSelfServiceLoginFlowWithPasswordMethod, err error) {
diff --git a/selfservice/strategy/password/registration.go b/selfservice/strategy/password/registration.go
index 854dc3ac1..285ba03fb 100644
--- a/selfservice/strategy/password/registration.go
+++ b/selfservice/strategy/password/registration.go
@@ -27,6 +27,7 @@ import (
 	"github.com/ory/kratos/schema"
 	"github.com/ory/kratos/selfservice/flow/registration"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/x"
 )
 
@@ -43,7 +44,8 @@ type RegistrationFormPayload struct {
 func (s *Strategy) RegisterRegistrationRoutes(public *x.RouterPublic) {
 	s.d.CSRFHandler().IgnorePath(RouteRegistration)
 
-	public.POST(RouteRegistration, s.d.SessionHandler().IsNotAuthenticated(s.handleRegistration, func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+	wrappedHandleRegistration := strategy.IsDisabled(s.d, s.ID().String(), s.handleRegistration)
+	public.POST(RouteRegistration, s.d.SessionHandler().IsNotAuthenticated(wrappedHandleRegistration, func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		handler := session.RedirectOnAuthenticated(s.d)
 		if x.IsJSONRequest(r) {
 			handler = session.RespondWithJSONErrorOnAuthenticated(s.d.Writer(), registration.ErrAlreadyLoggedIn)
diff --git a/selfservice/strategy/password/settings.go b/selfservice/strategy/password/settings.go
index 7449a5aab..ca1f7651a 100644
--- a/selfservice/strategy/password/settings.go
+++ b/selfservice/strategy/password/settings.go
@@ -22,6 +22,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/x"
 )
 
@@ -32,8 +33,9 @@ const (
 func (s *Strategy) RegisterSettingsRoutes(router *x.RouterPublic) {
 	s.d.CSRFHandler().IgnorePath(RouteSettings)
 
-	router.POST(RouteSettings, s.submitSettingsFlow)
-	router.GET(RouteSettings, s.submitSettingsFlow)
+	wrappedSubmmitSettingsFlow := strategy.IsDisabled(s.d, s.SettingsStrategyID(), s.submitSettingsFlow)
+	router.POST(RouteSettings, wrappedSubmmitSettingsFlow)
+	router.GET(RouteSettings, wrappedSubmmitSettingsFlow)
 }
 
 func (s *Strategy) SettingsStrategyID() string {
diff --git a/selfservice/strategy/profile/strategy.go b/selfservice/strategy/profile/strategy.go
index 8b576d14f..5bf374641 100644
--- a/selfservice/strategy/profile/strategy.go
+++ b/selfservice/strategy/profile/strategy.go
@@ -27,6 +27,7 @@ import (
 	"github.com/ory/kratos/selfservice/flow"
 	"github.com/ory/kratos/selfservice/flow/settings"
 	"github.com/ory/kratos/selfservice/form"
+	"github.com/ory/kratos/selfservice/strategy"
 	"github.com/ory/kratos/session"
 	"github.com/ory/kratos/x"
 )
@@ -87,8 +88,9 @@ func (s *Strategy) SettingsStrategyID() string {
 func (s *Strategy) RegisterSettingsRoutes(public *x.RouterPublic) {
 	s.d.CSRFHandler().IgnorePath(RouteSettings)
 
-	public.POST(RouteSettings, s.d.SessionHandler().IsAuthenticated(s.handleSubmit, settings.OnUnauthenticated(s.d)))
-	public.GET(RouteSettings, s.d.SessionHandler().IsAuthenticated(s.handleSubmit, settings.OnUnauthenticated(s.d)))
+	wrappedHandleSubmit := strategy.IsDisabled(s.d, s.SettingsStrategyID(), s.handleSubmit)
+	public.POST(RouteSettings, s.d.SessionHandler().IsAuthenticated(wrappedHandleSubmit, settings.OnUnauthenticated(s.d)))
+	public.GET(RouteSettings, s.d.SessionHandler().IsAuthenticated(wrappedHandleSubmit, settings.OnUnauthenticated(s.d)))
 }
 
 func (s *Strategy) PopulateSettingsMethod(r *http.Request, id *identity.Identity, pr *settings.Flow) error {
diff --git a/session/persistence.go b/session/persistence.go
index 407117885..6d3dbfa1a 100644
--- a/session/persistence.go
+++ b/session/persistence.go
@@ -47,11 +47,10 @@ type Persister interface {
 	RevokeSessionByToken(ctx context.Context, token string) error
 }
 
-func TestPersister(conf *config.Config, p interface {
+func TestPersister(ctx context.Context, conf *config.Config, p interface {
 	Persister
 	identity.PrivilegedPool
 }) func(t *testing.T) {
-	ctx := context.Background()
 	return func(t *testing.T) {
 		conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
 


Test patch:
diff --git a/driver/registry_default_test.go b/driver/registry_default_test.go
index e8611893d..d29341401 100644
--- a/driver/registry_default_test.go
+++ b/driver/registry_default_test.go
@@ -189,3 +189,43 @@ func TestDriverDefault_Strategies(t *testing.T) {
 		}
 	})
 }
+
+func TestDefaultRegistry_AllStrategies(t *testing.T) {
+	_, reg := internal.NewFastRegistryWithMocks(t)
+
+	t.Run("case=all login strategies", func(t *testing.T) {
+		expects := []string{"password", "oidc"}
+		s := reg.AllLoginStrategies()
+		require.Len(t, s, len(expects))
+		for k, e := range expects {
+			assert.Equal(t, e, s[k].ID().String())
+		}
+	})
+
+	t.Run("case=all registration strategies", func(t *testing.T) {
+		expects := []string{"password", "oidc"}
+		s := reg.AllRegistrationStrategies()
+		require.Len(t, s, len(expects))
+		for k, e := range expects {
+			assert.Equal(t, e, s[k].ID().String())
+		}
+	})
+
+	t.Run("case=all settings strategies", func(t *testing.T) {
+		expects := []string{"password", "oidc", "profile"}
+		s := reg.AllSettingsStrategies()
+		require.Len(t, s, len(expects))
+		for k, e := range expects {
+			assert.Equal(t, e, s[k].SettingsStrategyID())
+		}
+	})
+
+	t.Run("case=all recovery strategies", func(t *testing.T) {
+		expects := []string{"link"}
+		s := reg.AllRecoveryStrategies()
+		require.Len(t, s, len(expects))
+		for k, e := range expects {
+			assert.Equal(t, e, s[k].RecoveryStrategyID())
+		}
+	})
+}
diff --git a/persistence/sql/persister_test.go b/persistence/sql/persister_test.go
index 2575932d1..a751cd747 100644
--- a/persistence/sql/persister_test.go
+++ b/persistence/sql/persister_test.go
@@ -8,6 +8,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/ory/kratos/driver"
 
 	"github.com/go-errors/errors"
@@ -45,7 +47,7 @@ import (
 var sqlite = fmt.Sprintf("sqlite3://%s.sqlite?_fk=true&mode=rwc", filepath.Join(os.TempDir(), uuid.New().String()))
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 	// op.Debug = true
 }
 
@@ -93,7 +95,7 @@ func createCleanDatabases(t *testing.T) map[string]*driver.RegistryDefault {
 
 	var l sync.Mutex
 	if !testing.Short() {
-		funcs := map[string]func(t *testing.T) string{
+		funcs := map[string]func(t testing.TB) string{
 			"postgres":  dockertest.RunTestPostgreSQL,
 			"mysql":     dockertest.RunTestMySQL,
 			"cockroach": dockertest.RunTestCockroachDB}
@@ -102,7 +104,7 @@ func createCleanDatabases(t *testing.T) map[string]*driver.RegistryDefault {
 		wg.Add(len(funcs))
 
 		for k, f := range funcs {
-			go func(s string, f func(t *testing.T) string) {
+			go func(s string, f func(t testing.TB) string) {
 				defer wg.Done()
 				db := f(t)
 				l.Lock()
@@ -140,6 +142,7 @@ func createCleanDatabases(t *testing.T) map[string]*driver.RegistryDefault {
 
 func TestPersister(t *testing.T) {
 	conns := createCleanDatabases(t)
+	ctx := context.Background()
 
 	for name, reg := range conns {
 		t.Run(fmt.Sprintf("database=%s", name), func(t *testing.T) {
@@ -149,47 +152,47 @@ func TestPersister(t *testing.T) {
 			t.Logf("DSN: %s", conf.DSN())
 			t.Run("contract=identity.TestPool", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				identity.TestPool(conf, p)(t)
+				identity.TestPool(ctx, conf, p)(t)
 			})
 			t.Run("contract=registration.TestFlowPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				registration.TestFlowPersister(p)(t)
+				registration.TestFlowPersister(ctx, p)(t)
 			})
 			t.Run("contract=errorx.TestPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				errorx.TestPersister(p)(t)
+				errorx.TestPersister(ctx, p)(t)
 			})
 			t.Run("contract=login.TestFlowPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				login.TestFlowPersister(p)(t)
+				login.TestFlowPersister(ctx, p)(t)
 			})
 			t.Run("contract=settings.TestFlowPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				settings.TestRequestPersister(conf, p)(t)
+				settings.TestRequestPersister(ctx, conf, p)(t)
 			})
 			t.Run("contract=session.TestFlowPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				session.TestPersister(conf, p)(t)
+				session.TestPersister(ctx, conf, p)(t)
 			})
 			t.Run("contract=courier.TestPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				courier.TestPersister(p)(t)
+				courier.TestPersister(ctx, p)(t)
 			})
 			t.Run("contract=verification.TestPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				verification.TestFlowPersister(conf, p)(t)
+				verification.TestFlowPersister(ctx, conf, p)(t)
 			})
 			t.Run("contract=recovery.TestFlowPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				recovery.TestFlowPersister(conf, p)(t)
+				recovery.TestFlowPersister(ctx, conf, p)(t)
 			})
 			t.Run("contract=link.TestPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				link.TestPersister(conf, p)(t)
+				link.TestPersister(ctx, conf, p)(t)
 			})
 			t.Run("contract=continuity.TestPersister", func(t *testing.T) {
 				pop.SetLogger(pl(t))
-				continuity.TestPersister(p)(t)
+				continuity.TestPersister(ctx, p)(t)
 			})
 		})
 	}
diff --git a/selfservice/flow/login/handler_test.go b/selfservice/flow/login/handler_test.go
index 2166366e8..1f5b13495 100644
--- a/selfservice/flow/login/handler_test.go
+++ b/selfservice/flow/login/handler_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/gobuffalo/httptest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -26,7 +28,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestInitFlow(t *testing.T) {
diff --git a/selfservice/flow/recovery/handler_test.go b/selfservice/flow/recovery/handler_test.go
index 1e384f9c9..02165868c 100644
--- a/selfservice/flow/recovery/handler_test.go
+++ b/selfservice/flow/recovery/handler_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
@@ -25,7 +27,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestHandlerRedirectOnAuthenticated(t *testing.T) {
diff --git a/selfservice/flow/registration/handler_test.go b/selfservice/flow/registration/handler_test.go
index 749c7a0a0..66eccd445 100644
--- a/selfservice/flow/registration/handler_test.go
+++ b/selfservice/flow/registration/handler_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
@@ -25,7 +27,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestHandlerRedirectOnAuthenticated(t *testing.T) {
diff --git a/selfservice/flow/settings/handler_test.go b/selfservice/flow/settings/handler_test.go
index 60227173e..7e2877292 100644
--- a/selfservice/flow/settings/handler_test.go
+++ b/selfservice/flow/settings/handler_test.go
@@ -7,6 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/ory/x/ioutilx"
 
 	"github.com/stretchr/testify/assert"
@@ -29,7 +31,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestHandler(t *testing.T) {
diff --git a/selfservice/hook/session_destroyer_test.go b/selfservice/hook/session_destroyer_test.go
index fe92ae894..078ee0637 100644
--- a/selfservice/hook/session_destroyer_test.go
+++ b/selfservice/hook/session_destroyer_test.go
@@ -5,6 +5,8 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/bxcodec/faker/v3"
 	"github.com/gobuffalo/httptest"
 	"github.com/gofrs/uuid"
@@ -20,7 +22,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestSessionDestroyer(t *testing.T) {
diff --git a/selfservice/strategy/link/sender_test.go b/selfservice/strategy/link/sender_test.go
index 5e30d581c..f490b9a9b 100644
--- a/selfservice/strategy/link/sender_test.go
+++ b/selfservice/strategy/link/sender_test.go
@@ -64,14 +64,14 @@ func TestManager(t *testing.T) {
 
 		messages, err := reg.CourierPersister().NextMessages(context.Background(), 12)
 		require.NoError(t, err)
-		require.Len(t, messages, 4)
+		require.Len(t, messages, 2)
 
-		assert.EqualValues(t, "tracked@ory.sh", messages[2].Recipient)
-		assert.Contains(t, messages[2].Subject, "Please verify")
-		assert.Contains(t, messages[2].Body, urlx.AppendPaths(conf.SelfPublicURL(), link.RouteVerification).String()+"?token=")
+		assert.EqualValues(t, "tracked@ory.sh", messages[0].Recipient)
+		assert.Contains(t, messages[0].Subject, "Please verify")
+		assert.Contains(t, messages[0].Body, urlx.AppendPaths(conf.SelfPublicURL(), link.RouteVerification).String()+"?token=")
 
 		assert.EqualValues(t, "not-tracked@ory.sh", messages[1].Recipient)
-		assert.Contains(t, messages[3].Subject, "tried to verify")
-		assert.NotContains(t, messages[3].Body, urlx.AppendPaths(conf.SelfPublicURL(), link.RouteVerification).String()+"?token=")
+		assert.Contains(t, messages[1].Subject, "tried to verify")
+		assert.NotContains(t, messages[1].Body, urlx.AppendPaths(conf.SelfPublicURL(), link.RouteVerification).String()+"?token=")
 	})
 }
diff --git a/selfservice/strategy/link/strategy_recovery_test.go b/selfservice/strategy/link/strategy_recovery_test.go
index 635c9279c..d00ce5309 100644
--- a/selfservice/strategy/link/strategy_recovery_test.go
+++ b/selfservice/strategy/link/strategy_recovery_test.go
@@ -8,6 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/ory/x/ioutilx"
 
 	"github.com/stretchr/testify/assert"
@@ -36,7 +38,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func TestAdminStrategy(t *testing.T) {
@@ -128,6 +130,7 @@ func TestAdminStrategy(t *testing.T) {
 		require.Len(t, sr.Payload.Messages, 1)
 		assert.Equal(t, "You successfully recovered your account. Please change your password or set up an alternative login method (e.g. social sign in) within the next 60.00 minutes.", sr.Payload.Messages[0].Text)
 	})
+
 }
 
 func TestRecovery(t *testing.T) {
@@ -342,3 +345,55 @@ func TestRecovery(t *testing.T) {
 		assert.Contains(t, sr.Payload.Messages[0].Text, "The recovery flow expired")
 	})
 }
+
+func TestDisabledEndpoint(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	initViper(t, conf)
+	conf.MustSet(config.ViperKeySelfServiceStrategyConfig+"."+recovery.StrategyRecoveryLinkName+".enabled", false)
+
+	publicTS, adminTS := testhelpers.NewKratosServer(t, reg)
+	adminSDK := testhelpers.NewSDKClient(adminTS)
+
+	t.Run("role=admin", func(t *testing.T) {
+		t.Run("description=can not create recovery link when link method is disabled", func(t *testing.T) {
+			id := identity.Identity{Traits: identity.Traits(`{"email":"recovery-endpoint-disabled@ory.sh"}`)}
+
+			require.NoError(t, reg.IdentityManager().Create(context.Background(),
+				&id, identity.ManagerAllowWriteProtectedTraits))
+
+			uuid := models.UUID(id.ID.String())
+			rl, err := adminSDK.Admin.CreateRecoveryLink(admin.NewCreateRecoveryLinkParams().
+				WithBody(&models.CreateRecoveryLink{IdentityID: &uuid}))
+			assert.Nil(t, rl)
+			require.IsType(t, new(admin.CreateRecoveryLinkNotFound), err, "%s", err)
+
+			br, _ := err.(*admin.CreateRecoveryLinkNotFound)
+			assert.Contains(t, br.Payload.Error.Reason, "This endpoint was disabled by system administrator")
+		})
+	})
+
+	t.Run("role=public", func(t *testing.T) {
+		c := testhelpers.NewClientWithCookies(t)
+		t.Run("description=can not recover an account by get request when link method is disabled", func(t *testing.T) {
+			u := publicTS.URL + link.RouteRecovery + "?token=endpoint-disabled"
+			res, err := c.Get(u)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+
+		t.Run("description=can not recover an account by post request when link method is disabled", func(t *testing.T) {
+			u := publicTS.URL + link.RouteRecovery
+			res, err := c.PostForm(u, url.Values{"email": {"email@ory.sh"}})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+	})
+}
diff --git a/selfservice/strategy/oidc/strategy_settings_test.go b/selfservice/strategy/oidc/strategy_settings_test.go
index e0555dfb7..ee4805a9f 100644
--- a/selfservice/strategy/oidc/strategy_settings_test.go
+++ b/selfservice/strategy/oidc/strategy_settings_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -33,7 +35,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 var (
@@ -674,3 +676,35 @@ func TestPopulateSettingsMethod(t *testing.T) {
 		})
 	}
 }
+
+func TestDisabledSettingsEndpoint(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	testhelpers.StrategyEnable(t, conf, identity.CredentialsTypeOIDC.String(), false)
+
+	publicTS, _ := testhelpers.NewKratosServer(t, reg)
+
+	t.Run("case=should not complete settings oidc method is disabled", func(t *testing.T) {
+		c := testhelpers.NewClientWithCookies(t)
+
+		t.Run("method=GET", func(t *testing.T) {
+			res, err := c.Get(publicTS.URL + oidc.SettingsPath)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+
+		t.Run("method=POST", func(t *testing.T) {
+			res, err := c.PostForm(publicTS.URL+oidc.SettingsPath, url.Values{"link": {"xxx"}})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+	})
+
+}
diff --git a/selfservice/strategy/oidc/strategy_test.go b/selfservice/strategy/oidc/strategy_test.go
index 95672f5ae..6774a92ea 100644
--- a/selfservice/strategy/oidc/strategy_test.go
+++ b/selfservice/strategy/oidc/strategy_test.go
@@ -581,3 +581,45 @@ func TestCountActiveCredentials(t *testing.T) {
 		})
 	}
 }
+
+func TestDisabledEndpoint(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	testhelpers.StrategyEnable(t, conf, identity.CredentialsTypeOIDC.String(), false)
+
+	publicTS, _ := testhelpers.NewKratosServer(t, reg)
+
+	t.Run("case=should not callback when oidc method is disabled", func(t *testing.T) {
+		c := testhelpers.NewClientWithCookies(t)
+		res, err := c.Get(publicTS.URL + oidc.RouteCallback)
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+		b := make([]byte, res.ContentLength)
+		_, _ = res.Body.Read(b)
+		assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+	})
+
+	t.Run("case=should not auth when oidc method is disabled", func(t *testing.T) {
+		c := testhelpers.NewClientWithCookies(t)
+
+		t.Run("method=GET", func(t *testing.T) {
+			res, err := c.Get(publicTS.URL + oidc.RouteAuth)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+
+		t.Run("method=POST", func(t *testing.T) {
+			res, err := c.PostForm(publicTS.URL+oidc.RouteAuth, url.Values{"provider": {"github"}})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+	})
+}
diff --git a/selfservice/strategy/password/settings_test.go b/selfservice/strategy/password/settings_test.go
index 90d5bf74f..68ba2ba0e 100644
--- a/selfservice/strategy/password/settings_test.go
+++ b/selfservice/strategy/password/settings_test.go
@@ -10,6 +10,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tidwall/gjson"
@@ -31,7 +33,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func newIdentityWithPassword(email string) *identity.Identity {
diff --git a/selfservice/strategy/password/strategy_test.go b/selfservice/strategy/password/strategy_test.go
index 77c434edb..7f8fdcf44 100644
--- a/selfservice/strategy/password/strategy_test.go
+++ b/selfservice/strategy/password/strategy_test.go
@@ -3,8 +3,10 @@ package password_test
 import (
 	"context"
 	"fmt"
+	"github.com/ory/kratos/internal/testhelpers"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -105,3 +107,55 @@ func TestCountActiveCredentials(t *testing.T) {
 		})
 	}
 }
+
+func TestDisabledEndpoint(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	testhelpers.StrategyEnable(t, conf, identity.CredentialsTypePassword.String(), false)
+
+	publicTS, _ := testhelpers.NewKratosServer(t, reg)
+
+	c := testhelpers.NewClientWithCookies(t)
+	t.Run("case=should not login when password method is disabled", func(t *testing.T) {
+		res, err := c.PostForm(publicTS.URL+password.RouteLogin, url.Values{"identifier": []string{"identifier"}, "password": []string{"password"}})
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+		b := make([]byte, res.ContentLength)
+		_, _ = res.Body.Read(b)
+		assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+	})
+
+	t.Run("case=should not registration when password method is disabled", func(t *testing.T) {
+
+		res, err := c.PostForm(publicTS.URL+password.RouteRegistration, url.Values{"identifier": []string{"identifier"}, "password": []string{"password"}})
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+		b := make([]byte, res.ContentLength)
+		_, _ = res.Body.Read(b)
+		assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+	})
+
+	t.Run("case=should not settings when password method is disabled", func(t *testing.T) {
+
+		t.Run("method=GET", func(t *testing.T) {
+			res, err := c.Get(publicTS.URL + password.RouteSettings)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+
+		t.Run("method=POST", func(t *testing.T) {
+			res, err := c.PostForm(publicTS.URL+password.RouteSettings, url.Values{"age": {"16"}})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+	})
+}
diff --git a/selfservice/strategy/profile/strategy_test.go b/selfservice/strategy/profile/strategy_test.go
index f447fceb9..20e6d405a 100644
--- a/selfservice/strategy/profile/strategy_test.go
+++ b/selfservice/strategy/profile/strategy_test.go
@@ -13,6 +13,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/julienschmidt/httprouter"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,7 +38,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func newIdentityWithPassword(email string) *identity.Identity {
@@ -493,3 +495,35 @@ func TestStrategyTraits(t *testing.T) {
 		})
 	})
 }
+func TestDisabledEndpoint(t *testing.T) {
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	conf.MustSet(config.ViperKeyDefaultIdentitySchemaURL, "file://./stub/identity.schema.json")
+	testhelpers.StrategyEnable(t, conf, settings.StrategyProfile, false)
+
+	publicTS, _ := testhelpers.NewKratosServer(t, reg)
+	browserIdentity1 := newIdentityWithPassword("john-browser@doe.com")
+	browserUser1 := testhelpers.NewHTTPClientWithIdentitySessionCookie(t, reg, browserIdentity1)
+
+	t.Run("case=should not submit when profile method is disabled", func(t *testing.T) {
+
+		t.Run("method=GET", func(t *testing.T) {
+			res, err := browserUser1.Get(publicTS.URL + profile.RouteSettings)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, 10000)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+
+		t.Run("method=POST", func(t *testing.T) {
+			res, err := browserUser1.PostForm(publicTS.URL+profile.RouteSettings, url.Values{"age": {"16"}})
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b := make([]byte, res.ContentLength)
+			_, _ = res.Body.Read(b)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator")
+		})
+	})
+}
diff --git a/session/handler_test.go b/session/handler_test.go
index 389708115..b39d8b654 100644
--- a/session/handler_test.go
+++ b/session/handler_test.go
@@ -8,6 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/ory/kratos/corpx"
+
 	"github.com/julienschmidt/httprouter"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -27,7 +29,7 @@ import (
 )
 
 func init() {
-	internal.RegisterFakes()
+	corpx.RegisterFakes()
 }
 
 func send(code int) httprouter.Handle {