PUT identity does not update verifiable_addresses

[timblackwell]

Preflight checklist

• [x] I could not find a solution in the existing issues, docs, nor discussions.
• [x] I agree to follow this project's Code of Conduct.
• [x] I have read and am following this repository's Contribution Guidelines.
• [x] I have joined the Ory Community Slack.
• [x] I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

I am trying to set an address as verified using the a PUT to the admin identities endpoint. I do not get an error, but the change is not applied. A PATCH request does work though, so assume there is some bug with the PUT request that is not present on the PATCH endpoint.

Reproducing the bug

1. Create one identity without verifying their email address.
2. Make PUT request, updating the first item in verifiable_addresses array to have verified: true, status: completed and the verified_at dateTime set:

    "verifiable_addresses": [
      {
        "id": "f33f7315-c5b2-45b1-815e-aa64260f92ae",
        "value": "REDACTED",
        "verified": true,
        "via": "email",
        "status": "completed",
        "verified_at": "2025-02-11T13:20:22.247891Z",
        "created_at": "2024-02-11T13:20:22.247891Z",
        "updated_at": "2024-02-11T13:20:22.247891Z"
      }
    ],

3. Observe the response does not include the updates to verifiable_addresses.

Relevant log output

Relevant configuration

Version

Ory Network

On which operating system are you observing this issue?

Ory Network

In which environment are you deploying?

Ory Network

Additional Context

No response

[till]

I am using this in a webhook:

{
  identity: {
    traits: {
     ...
    },
    verified_addresses: std.prune([
      if 'email' in claims && claims.email_verified then { via: 'email', value: claims.email },
    ]),
  }
}

Note the difference, verified_addresses vs. verifiable_adresses. And I think you have to make sure that the email in your traits matches the verified_addresses too. I found this via issues and pull requests, but it was a bit hard to uncover. Tested this with Kratos v1.3.1.

TL;DR — I think verifiable_addresses is internal and only updated by the confirmation flow.