POST

Authentication

Register account

/api/v2/registrations
AUTHENTICATIONNone · publicService owneridentity-access · identity-serviceContract sourceOpenAPISTATUSProduction listed
Public registration is closed

This route returns 403 invitation_required. Accounts currently require an administrator invitation. The retained request schema does not mean public signup is enabled. This behavior was verified on 2026-10-02; the generic step_up_required example in the captured OpenAPI is not the registration response.

Purpose and usage

What this endpoint does

Public account registration is closed. The V2 gateway returns 403 invitation_required.

When to use it

Read this reference when planning onboarding; use the restricted administrator invitation workflow for current account creation.

OUTCOME · Registration closed · invitation required

What changes

The public route rejects registration without creating an account, activation delivery, or session.

WHY IT MATTERS

  • Makes current account-opening policy explicit before an integration collects personal data.

ISOLATION + AUTHORITY

The public route cannot bypass administrator invitation or tenant account policy.

BEFORE YOU CALL

  • An administrator invitation for current onboarding; public registration is not enabled.

WHAT TO DO NEXT

  • Arrange an administrator invitation.
  • For existing accounts, use the session creation endpoint.

AGENT GUIDANCE

  • Do not retry invitation_required with different personal data or credentials.
  • Do not mistake a production-listed route or retained request schema for permission to open accounts.
Contract reference

Use the deployed OpenAPI for exact parameters, schemas and security requirements. The tables below provide integration guidance.

Open this operation in OpenAPI

Request and response

Make the request

Examples illustrate integration intent; the referenced OpenAPI operation and component schemas define the executable shape.

PARAMETERS

Headers, path, query, and body

NAMELOCATIONPRESENCETYPE / RULES / PURPOSE
X-Request-IDheaderOptional

stringOptional caller correlation identifier. The gateway emits the effective value on the response.

account_typebodyRequired

AccountTypePersonal accounts require first and last name; corporate accounts require company name.Allowed: personal | corporateEXAMPLEaccount-type-01

company_namebodyOptional

string · max 160 · nullableRequired for corporate accounts and ignored for personal accounts.Explicit null acceptedEXAMPLEcompany-name-01

emailbodyRequired

email address · max 128Login and activation-delivery address, normalized to lowercase by Identity.EXAMPLE[email protected]

first_namebodyOptional

string · max 100 · nullableAuthoritative first name value defined by this V2 schema.Explicit null acceptedEXAMPLEfirst-name-01

last_namebodyOptional

string · max 100 · nullableAuthoritative last name value defined by this V2 schema.Explicit null acceptedEXAMPLElast-name-01

middle_namebodyOptional

string · max 100 · nullableAuthoritative middle name value defined by this V2 schema.Explicit null acceptedEXAMPLEmiddle-name-01

passwordbodyRequired

printable string · 12–12812–128 printable characters, at least three character classes, and no email local-part reuse.EXAMPLEpassword-01

tenant_uuidbodyOptional

tenant identifier · nullableOptional tenant or white-label registration boundary. Omission selects the global tenant.Explicit null acceptedEXAMPLE7d44d4fbf2c14a65a7074692b2b77472

termsbodyRequired

TermsAcceptanceaccepted must be true and version is required; privacy_policy_version is optional.EXAMPLE[object Object]

STABLE ERROR CODES

Branch on the code, then follow the recovery action

These codes are published by the authoritative gateway contract for this endpoint. Treat message as safe diagnostic text; integrations should branch on code and HTTP status.

STATUSCODEMEANING
403invitation_requiredPublic registration is closed; an administrator invitation is required.

RESPONSES

Status and payload examples

403public account registration is closed; accounts can only be created through an administrator invitationRegistration closed · JSON RESPONSE+
{
  "code": "invitation_required",
  "message": "public account registration is closed; accounts can only be created through an administrator invitation"
}
INTEGRATION DECISIONinvitation_required
CALLER ACTION
Use the restricted administrator invitation workflow; this route does not open public accounts.
RETRY SAFETY
Do not retry until public registration policy explicitly changes. Authenticator step-up does not enable signup.
STATE RECONCILIATION
No account or activation delivery was created by this request.

OPERATIONAL NOTES

Security and lifecycle guarantees

  • Public registration is blocked by the gateway and website handlers. No account, activation email, or session is created.
  • The request schema is retained for reference; do not build public signup against it until registration is explicitly enabled.
  • Verified on 2026-10-02 against the live route and gateway handler. The captured OpenAPI's generic step_up_required response example does not describe this route's actual rejection.

UPGRADING FROM V1

Legacy calls replaced by this operation

If you maintain an older integration, use this map to find the V2 replacement. Do not translate the old request field-for-field: rebuild it from the V2 parameters and schemas above because identity, authorization, replay protection, and response semantics may have changed.

POST/api/v1/auth/registrationAUTH: Register a Private User
Reference version and availability details

This route is implemented in canonical gateway source and appears in the production OpenAPI snapshot observed 2026-10-02T23:27:55.510Z. Authentication, tenant, feature, venue, and market policy still apply.

Verify the exact production OpenAPI operation Return to the V2 directory