import kratos

Streams a CMF file and creates one identity per user via POST /admin/identities against the Kratos instance at --admin-url. Kratos has no bulk-import job like Auth0’s, so identities are created one at a time; a failed identity is recorded in import-report.json without stopping the run.

For a step-by-step walkthrough, including identity schema requirements and verifying logins, see Import users into Ory Kratos.

Usage

export KRATOS_ADMIN_URL=http://127.0.0.1:4434

iamigrate import kratos --in users.cmf.jsonl.gz --schema-id default

Flags

Flag	Description
--in	CMF users.cmf.jsonl.gz path (required)
--schema-id	Kratos identity schema ID to create identities against (default default)
--admin-url	Kratos Admin API base URL (or $KRATOS_ADMIN_URL)
--report	import-report.json output path (default: alongside --in)

Each CMF user’s first email becomes the email trait and, if present, username becomes the username trait and the first phone number becomes the phone trait; every other identity schema trait comes from user_metadata. app_metadata maps to metadata_admin, user_metadata to metadata_public, and blocked: true maps to Kratos’ inactive state.

Attention

Only bcrypt and argon2id password hashes are translated. A user with any other algorithm is not created and is reported under failed with TRANSLATION_ERROR. sms, email, push, and webauthn factors are dropped and the user is listed under requires_reenrollment. totp and recovery_codes factors are sent to Kratos, but Kratos v1.3.1 rejects them, so those users fail. Run iamigrate validate --target kratos first to catch unsupported hashes before importing.