POST /auth /registration / delegated

Edit online

By using POST /auth API, you can use your own authentication system, while still using Delegated Signing, you can use this endpoint to register a new End User in your organization, without your user needing to receive an email from IBM.

This endpoint will:
  1. Create a new User attached to your organization
  2. Initiates a User Registration Challenge and returns the registration challenge.
Authentication
Service Account
Required Permissions
Auth:Register:Delegated: Always required.
Authorizations
Bearer Token: To authenticate API requests.
X-DFNS-USERACTION
User Action Signature: Used to sign the change-inducing API requests.
Parameters

email: Minimum length: 1

kind enum: Available options: EndUser

externalId: Minimum length: 1

Request body
{
curl --request POST \
  --url https://api.digitalassets.ibm.com/auth/registration/delegated \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '{
  "email": "<string>",
  "kind": "EndUser",
  "externalId": "<string>"
}'
Response
200: Success 
{
  "user": {
    "id": "<string>",
    "displayName": "<string>",
    "name": "<string>"
  },
  "temporaryAuthenticationToken": "<string>",
  "challenge": "<string>",
  "supportedCredentialKinds": {
    "firstFactor": [
      "Fido2"
    ],
    "secondFactor": [
      "Fido2"
    ]
  },
  "authenticatorSelection": {
    "residentKey": "required",
    "requireResidentKey": true,
    "userVerification": "required",
    "authenticatorAttachment": "platform"
  },
  "attestation": "none",
  "pubKeyCredParams": [
    {
      "type": "public-key",
      "alg": 123
    }
  ],
  "excludeCredentials": [
    {
      "type": "public-key",
      "id": "cr-6uunn-bm6ja-f6rmod5kqrk5rbel"
    }
  ],
  "otpUrl": "<string>",
  "rp": {
    "id": "<string>",
    "name": "<string>"
  }
}