/v1/auth/signupCreate a new account and sign in
Request body
email*stringUser email address
Example: "user@example.com"
username*stringUnique username (letters, numbers, dot, underscore, hyphen)
Example: "john_doe"
password*stringUser password (min 8 characters)
Example: "MySecurePassword123"
display_namestringDisplay name
Example: "John Doe"
session_durationobjectSession duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
Example: "long"
Response · 200 Token response
access_token*stringSigned JWT, audience-bound to the resource indicator and carrying the workspace, the preset name and the client id. It carries no policy — authority is resolved per request from the grant row and the human’s live policy.
token_type*stringExample: "Bearer"
expires_in*numberSeconds until the access token expires (≤ 900).
Example: 900
refresh_token*stringRotating refresh token. The one presented is consumed; replaying it revokes the whole grant family.
scope*stringPreset name(s) the grant started from. Present for RFC 6749 §5.1 compliance; it is not the authority — `policy` is.
Example: "mail"
policy*arrayThe policy this token carries. Effective authority is this intersected with the authorizing human's current workspace policy, re-evaluated on every call.
workspace_id*string · uuidWorkspace the grant is scoped to.
Example
Request
POST /v1/auth/signup
Content-Type: application/json
{
"email": "user@example.com",
"username": "john_doe",
"password": "MySecurePassword123",
"display_name": "John Doe",
"session_duration": "long"
}Response
{
"access_token": "string",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token": "string",
"scope": "mail",
"policy": [
{
"effect": "allow",
"actions": [
"social.read",
"social.list"
],
"resources": [
"*"
]
}
],
"workspace_id": "00000000-0000-0000-0000-000000000000"
}