Register a new account
POST/api/auth/signup
Self-service account registration. New accounts are created with no elevated privileges; access is granted later through the staff-only user-management routes. Gated by the allowSignup system setting, and protected by a tiered rate limiter: repeated attempts escalate from silent friction, to a captcha challenge (428), to an outright block (429). The password must satisfy the strength policy.
Request
Responses
- 201
- 400
- 403
- 409
- 428
- 429
- 500
Account created.
Missing fields, invalid email, or weak password.
Signup is disabled.
Email already registered.
Rate limiter requires a captcha challenge; retry with captchaToken.
Too many attempts; retry after the Retry-After header.
Server error.