Creates an account and signs it in.
Errors
404 when the instance has no accounts, 403 when registration is closed,
409 when the name or address is taken, 400 when a value fails its rule.
application/json- body
Body of POST /auth/register.
email*stringAddress to reach the account at.
emailinvite_code?|An invite code, on an instance that asks for one.
Ignored where registration is open, so a client does not have to know
which kind of instance it is talking to before filling in the form.
/capabilities says which it is.
password*stringAt least password_min_length characters. See /capabilities.
8 <= length <= 1024username*string3–32 characters: letters, digits, _ and -, starting with a letter or
digit. Stored lowercased.
^[a-zA-Z0-9][a-zA-Z0-9_-]*$3 <= length <= 32Account created and signed in; only where this instance sends no mail
application/json- response
An account, as the API describes it. Never carries a hash.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
curl -X POST 'https://example.com/api/v1/auth/register' \ -H 'Content-Type: application/json' \ -d '{ "email": "user@example.com", "password": "stringst", "username": "string"}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string"}