curl --request POST \
--url https://{host}/v1/users \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "users",
"attributes": {
"clientId": "9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34",
"email": "jeffrey@example.test",
"password": "the-one-they-chose",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"scope": "internal messages:read messages:write"
}
}
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'users',
attributes: {
clientId: '9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34',
email: 'jeffrey@example.test',
password: 'the-one-they-chose',
name: 'Jeffrey',
lastName: 'Ponsen',
locale: 'nl',
scope: 'internal messages:read messages:write'
}
}
})
};
fetch('https://{host}/v1/users', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/users",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'users',
'attributes' => [
'clientId' => '9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34',
'email' => 'jeffrey@example.test',
'password' => 'the-one-they-chose',
'name' => 'Jeffrey',
'lastName' => 'Ponsen',
'locale' => 'nl',
'scope' => 'internal messages:read messages:write'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/users"
payload = { "data": {
"type": "users",
"attributes": {
"clientId": "9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34",
"email": "jeffrey@example.test",
"password": "the-one-they-chose",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"scope": "internal messages:read messages:write"
}
} }
headers = {"Content-Type": "application/vnd.api+json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "users",
"id": "15",
"attributes": {
"email": "jeffrey@example.test",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"emailVerified": false
}
},
"meta": {
"session": {
"accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9…",
"refreshToken": "def50200f1e3…",
"tokenType": "Bearer",
"expiresIn": 3600
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "422",
"code": "implausible_email",
"title": "Unprocessable Entity",
"detail": "Did you mean jan@gmail.com?",
"source": {
"pointer": "/data/attributes/email"
},
"meta": {
"suggestion": "jan@gmail.com",
"domain": "gnail.com"
}
}
]
}Create account
Scope: none — this happens before there is a token.
Creates the account and sends the verification email, exactly as signing up on
the website does — and signs them in while doing it. meta.session carries the
same tokens the token endpoint would have handed over a moment later, because
it is the same grant asked in-process: making somebody type the password they
chose thirty seconds ago would be a worse version of the website.
Name the scopes you want in scope, exactly as you would at the token
endpoint (space-separated, at most 255 characters).
meta.session is left out when no session could be issued — a first-party client
registered without the grant, or a scope the token endpoint would refuse. The
account still exists and the answer is still 201; meta.detail says to sign in at
the token endpoint instead.
The body: clientId and email (at most 255, not already registered) and password
(the website’s password policy) are required; name and lastName (at most 255 each,
may be null), locale (en, nl, de, es, fr, it, pt, fi or pl; the
request’s language when left out), scope and emailConfirmed are optional.
The account works before the address is verified — verification gates what
somebody may do, not whether they may sign in — so emailVerified is false
here and the app lands on the screen that asks them to confirm.
A mistyped address is questioned first, with the website’s own check: a domain
a typo away from a popular one (gnail.com, hotmai.com) or one that receives no
mail. The answer is 422 with code implausible_email, source.pointer
/data/attributes/email, detail ready to show (“Did you mean jan@gmail.com?”)
and meta.suggestion — the address probably meant, or null when there is no
guess — and meta.domain. Offer the suggestion, and a “use anyway” that sends
the same request again with emailConfirmed set to the address as typed. It is
the address itself, not a flag, so editing the address afterwards asks again.
Never stored, never read back.
The Wristler app only. Send the clientId it signs in with; any other kind
of client is refused with 403. A partner integrates with a business that
already exists, and an account created through them is one we could not explain
to whoever owns that address.
curl --request POST \
--url https://{host}/v1/users \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "users",
"attributes": {
"clientId": "9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34",
"email": "jeffrey@example.test",
"password": "the-one-they-chose",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"scope": "internal messages:read messages:write"
}
}
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'users',
attributes: {
clientId: '9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34',
email: 'jeffrey@example.test',
password: 'the-one-they-chose',
name: 'Jeffrey',
lastName: 'Ponsen',
locale: 'nl',
scope: 'internal messages:read messages:write'
}
}
})
};
fetch('https://{host}/v1/users', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/users",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'users',
'attributes' => [
'clientId' => '9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34',
'email' => 'jeffrey@example.test',
'password' => 'the-one-they-chose',
'name' => 'Jeffrey',
'lastName' => 'Ponsen',
'locale' => 'nl',
'scope' => 'internal messages:read messages:write'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/users"
payload = { "data": {
"type": "users",
"attributes": {
"clientId": "9f2c1b7e-4d3a-4f61-9c8b-2e5a7d0f1b34",
"email": "jeffrey@example.test",
"password": "the-one-they-chose",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"scope": "internal messages:read messages:write"
}
} }
headers = {"Content-Type": "application/vnd.api+json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "users",
"id": "15",
"attributes": {
"email": "jeffrey@example.test",
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"emailVerified": false
}
},
"meta": {
"session": {
"accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9…",
"refreshToken": "def50200f1e3…",
"tokenType": "Bearer",
"expiresIn": 3600
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "422",
"code": "implausible_email",
"title": "Unprocessable Entity",
"detail": "Did you mean jan@gmail.com?",
"source": {
"pointer": "/data/attributes/email"
},
"meta": {
"suggestion": "jan@gmail.com",
"domain": "gnail.com"
}
}
]
}