curl --request POST \
--url https://my.server.express/api/v1/auth/register \
--header 'Content-Type: application/json' \
--data '
{
"email": "[email protected]",
"password": "<string>",
"firstName": "<string>",
"lastName": "<string>",
"turnstileToken": "<string>",
"addressLine1": "<string>",
"city": "<string>",
"postcode": "<string>",
"country": "<string>",
"phoneNumber": "<string>",
"clientType": "INDIVIDUAL",
"companyName": "<string>",
"vatNumber": "<string>",
"addressLine2": "<string>",
"region": "<string>",
"marketingConsent": true,
"attribution": {
"landingPath": "<string>",
"referrer": "<string>",
"utmSource": "<string>",
"utmMedium": "<string>",
"utmCampaign": "<string>",
"partnerCode": "<string>"
}
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
email: '[email protected]',
password: '<string>',
firstName: '<string>',
lastName: '<string>',
turnstileToken: '<string>',
addressLine1: '<string>',
city: '<string>',
postcode: '<string>',
country: '<string>',
phoneNumber: '<string>',
clientType: 'INDIVIDUAL',
companyName: '<string>',
vatNumber: '<string>',
addressLine2: '<string>',
region: '<string>',
marketingConsent: true,
attribution: {
landingPath: '<string>',
referrer: '<string>',
utmSource: '<string>',
utmMedium: '<string>',
utmCampaign: '<string>',
partnerCode: '<string>'
}
})
};
fetch('https://my.server.express/api/v1/auth/register', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/register"
payload = {
"email": "[email protected]",
"password": "<string>",
"firstName": "<string>",
"lastName": "<string>",
"turnstileToken": "<string>",
"addressLine1": "<string>",
"city": "<string>",
"postcode": "<string>",
"country": "<string>",
"phoneNumber": "<string>",
"clientType": "INDIVIDUAL",
"companyName": "<string>",
"vatNumber": "<string>",
"addressLine2": "<string>",
"region": "<string>",
"marketingConsent": True,
"attribution": {
"landingPath": "<string>",
"referrer": "<string>",
"utmSource": "<string>",
"utmMedium": "<string>",
"utmCampaign": "<string>",
"partnerCode": "<string>"
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Create an account
Creates a client account with a billing profile and signs it in straight away (201 with a session). A confirmation email goes out in the background; a mail failure doesn’t fail the signup. Throwaway email domains are refused. Countries under sanctions or compliance restrictions get 403. Requires a Cloudflare Turnstile token. Rate-limited to 10 requests per 15 minutes per IP. Attribution fields are sanitised hard — anything that looks like a credential or an email address is dropped, the landing path keeps only its path and the referrer only its host. Writes a REGISTER audit entry recording marketing consent.
curl --request POST \
--url https://my.server.express/api/v1/auth/register \
--header 'Content-Type: application/json' \
--data '
{
"email": "[email protected]",
"password": "<string>",
"firstName": "<string>",
"lastName": "<string>",
"turnstileToken": "<string>",
"addressLine1": "<string>",
"city": "<string>",
"postcode": "<string>",
"country": "<string>",
"phoneNumber": "<string>",
"clientType": "INDIVIDUAL",
"companyName": "<string>",
"vatNumber": "<string>",
"addressLine2": "<string>",
"region": "<string>",
"marketingConsent": true,
"attribution": {
"landingPath": "<string>",
"referrer": "<string>",
"utmSource": "<string>",
"utmMedium": "<string>",
"utmCampaign": "<string>",
"partnerCode": "<string>"
}
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
email: '[email protected]',
password: '<string>',
firstName: '<string>',
lastName: '<string>',
turnstileToken: '<string>',
addressLine1: '<string>',
city: '<string>',
postcode: '<string>',
country: '<string>',
phoneNumber: '<string>',
clientType: 'INDIVIDUAL',
companyName: '<string>',
vatNumber: '<string>',
addressLine2: '<string>',
region: '<string>',
marketingConsent: true,
attribution: {
landingPath: '<string>',
referrer: '<string>',
utmSource: '<string>',
utmMedium: '<string>',
utmCampaign: '<string>',
partnerCode: '<string>'
}
})
};
fetch('https://my.server.express/api/v1/auth/register', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/register"
payload = {
"email": "[email protected]",
"password": "<string>",
"firstName": "<string>",
"lastName": "<string>",
"turnstileToken": "<string>",
"addressLine1": "<string>",
"city": "<string>",
"postcode": "<string>",
"country": "<string>",
"phoneNumber": "<string>",
"clientType": "INDIVIDUAL",
"companyName": "<string>",
"vatNumber": "<string>",
"addressLine2": "<string>",
"region": "<string>",
"marketingConsent": True,
"attribution": {
"landingPath": "<string>",
"referrer": "<string>",
"utmSource": "<string>",
"utmMedium": "<string>",
"utmCampaign": "<string>",
"partnerCode": "<string>"
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Body
Must match ^[^\s@]+@[^\s@]+\.[^\s@]+$. Stored lowercased and trimmed.
8Cloudflare Turnstile token (action register).
ISO 3166-1 alpha-2 code. Uppercased before checks.
2Anything other than BUSINESS is treated as INDIVIDUAL.
INDIVIDUAL, BUSINESS Required when clientType is BUSINESS. Ignored otherwise.
Kept only for BUSINESS accounts.
State / province / county. Required for countries whose addresses use one.
64Only a literal JSON true counts as consent. Anything else is stored as no.
Where the visitor came from. All optional. Values that look like credentials or email addresses are dropped whole, and nothing is stored when every field ends up empty.
Show child attributes
Show child attributes