Start passwordless signup

POST 
/api/v1/auth/signup

Begin passwordless signup by sending a confirmation email.

Only email is collected; name and password are set later when the user completes POST /auth/confirm-email. The endpoint always returns a success message regardless of whether the email is already registered (email-enumeration safety).

• Router-gated by release_register — returns 404 when registration is off.
• Rate limit: 1000 / hour / IP (auth_signup tier). The limiter keys on IP, and a whole office, campus or VPN shares one — at 5/hour a company onboarding its team hits the wall on the sixth person, and the anti-abuse value was small anyway because signup already reveals nothing about an existing address. The ceiling is now a runaway guard, not a throttle; raise or lower it live through runtime_rate_limit_auth_signup.
• 503 if the instance can neither mail the link (no Resend API key) nor hand it back (local_instant_signup, development environments only). A local box with neither is genuinely unable to complete a signup, so it says so rather than creating an account nobody can ever confirm.

Request

Responses

200

Successful Response

400

Bad request — malformed input or failed validation.

404

Resource not found, or hidden for tenant-enumeration safety (the caller lacks permission to know whether the resource exists).

409

Conflict — the current resource state does not allow this operation (e.g. assessment already started, email already in use).

422

Semantic validation failure — request shape was valid but contents were not.

429

Too many requests — rate limited. Retry after the window resets.

500

Internal server error — unexpected failure.