POST /auth/users/register-with-policy

Registers the user on both auth-svc and policy-svc. Same request and response shape as /auth/users/register — the difference is the second leg.

Used in flow: Sign-up, on deployments that run policy-svc

Authentication: JWT (Access Token)

/auth/users/register does not create the user in policy-svc. A user registered through it has no policy-svc record, so every signing request is denied — policy evaluation fails closed on an unknown user. If your deployment sets FEATURE_POLICY_EVALUATION=true, register through this endpoint instead.

Both legs are idempotent, so retrying a failed call is safe.

Request

Content-Type: application/json

{
  "access_token": "string"
}

Field	Type	Required	Description
access_token	string	Yes	The JWT access token. Sent in the body, not the Authorization header

On a Firebase deployment (AUTH_PROVIDER=firebase) the field is firebaseIdToken instead.

Response

201 Created — new user

{
  "success": true,
  "message": "User registered successfully"
}

200 OK — user already existed

{
  "success": true,
  "message": "User already exists"
}

Group assignment

policy-svc puts every new user in the seeded default-policy group (00000000-0000-0000-0000-000000000000). Groups cannot be created, and users cannot be moved between them — see Admin Policy Endpoints.

That group starts with a policy that has no rules, and a request matching no rule is denied. Registering here is necessary but not sufficient: an admin still has to save a policy before signing works. See Setting the first policy.

Errors

Status	Body	Cause
400	{"error":"Missing request body","code":100201}	Empty body
400	{"error":"Invalid JSON body","code":100202}	Body is not valid JSON
401	{"error":"Authentication failed","code":100110}	No access_token field, or the token failed verification
500	{"error":"User object creation failed unexpectedly","code":100404}	The auth-svc leg failed
500	{"error":"Failed to register user on policy service","code":100410,"details":"..."}	The policy-svc leg failed — rejected, unreachable, or POLICY_SVC_URL unset

Failure of the policy-svc leg is strict: the endpoint returns 100410 rather than a partial success, so the client knows to retry. The auth-svc user may already exist at that point; the retry is idempotent on both sides.