Create an account
Create an account
/api/v1/auth/registerCreates a user and password credential, then issues an account-only
browser session. No Workspace is created during registration. The
caller must create their first Workspace through
POST /api/v1/workspaces/bootstrap before using Workspace-scoped
operations, or accept a Workspace invitation. Without invitation_token,
the address starts unverified and a verification message is sent.
A valid pending invitation for the supplied email verifies that address
without a second email. Registration does not consume the invitation
or grant membership; accepting it remains a separate explicit action.
Invalid, expired, revoked, used or mismatched invitation credentials
return 400 invalid_invitation without creating an account.
Verification gates account recovery, not access: a password reset is never issued for an unverified address, because whoever controls that inbox has not proven they own the account.
A taken address is reported plainly. Registration necessarily reveals whether an address can be registered, so a vague failure would only strand a user who already has an account.
Request Body
application/jsonstring <email>·min 3·max 320Normalized to lowercase and trimmed before storage and comparison.
string <password>·min 12·max 128Between 12 and 128 characters. There are deliberately no composition rules: length and non-reuse resist guessing, while character-class rules mostly produce predictable substitutions. Passwords appearing in a known breach corpus are refused.
string·min 1·max 100Optional. When omitted, a starting name is derived from the local part of the address; it is a default the user can change, not an identity claim.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <email>·min 3·max 320Normalized to lowercase and trimmed before storage and comparison.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.