Register User

Endpoint

POST {{base_url}}/v1/auth/register

Headers

Header	Value
`Content-Type`	`application/json`

This endpoint does not require authentication — it's used to create a new account.

Body Parameters

Parameter	Type	Required	Description
`firstname`	string	Yes	User's first name.
`lastname`	string	Yes	User's last name.
`email`	string	Yes	Email address. Must not already be registered.
`username`	string	Yes	Desired username. Must not already be taken.
`password`	string	Yes	Account password. See Password Requirements below.
`password_confirmation`	string	Yes	Must match `password` exactly.
`mobile_no`	string	No	Mobile number. If provided, must not already be registered.
`country`	string	No	User's country.

Password Requirements

password must satisfy all of the following:

Rule	Requirement
Length	At least 8 characters
Uppercase	At least one uppercase letter (`A–Z`)
Lowercase	At least one lowercase letter (`a–z`)
Digit	At least one number (`0–9`)
Special character	At least one non-alphanumeric character

If any rule fails, the request is rejected with the specific message for that rule (see Error Responses).

Example Request

{
  "firstname": "John",
  "lastname": "Doe",
  "email": "[email protected]",
  "username": "johndoe",
  "password": "Strong@123",
  "password_confirmation": "Strong@123",
  "mobile_no": "919876543210",
  "country": "India"
}

curl --location '{{base_url}}/v1/auth/register' \
--header 'Content-Type: application/json' \
--data '{
    "firstname": "John",
    "lastname": "Doe",
    "email": "[email protected]",
    "username": "johndoe",
    "password": "Strong@123",
    "password_confirmation": "Strong@123",
    "mobile_no": "919876543210",
    "country": "India"
}'

What Happens on Registration

When a registration request passes all validation, the following are created together (all-or-nothing — if any step fails, nothing is saved):

Main account record — your login, profile, and account settings.
Default team assignment — you're added to a default team.
Starting credits — new accounts are seeded with:

Credit type Starting amount
whatsapp_marketing_credits 10
whatsapp_utility_credits 10
voice_credits 10
Default permissions — a baseline permission set is created for the account (e.g. report access, broadcast via master reseller, read-status broadcast, voice credits access, client management, invoice, support, and reseller settings are enabled by default; several others like SMS credits, WhatsApp credits, RCS, GSM, Telegram, and Instagram are disabled by default).

Credit type	Starting amount
`whatsapp_marketing_credits`	10
`whatsapp_utility_credits`	10
`voice_credits`	10

Confirm the exact success response shape returned by the route (e.g. { "message": "..." } and/or user/account details) — the underlying function completes without returning a payload itself, so the response body depends on how the route wraps it.

Validation Rules

password must meet all Password Requirements.
password and password_confirmation must match exactly.
email must not already be registered.
username must not already be taken (checked against both admin accounts and assigned users).
mobile_no, if provided, must not already be registered to another account.

Error Responses

Status	Message	Reason
`400`	`Password must be at least 8 characters`	Password too short.
`400`	`Password must contain at least one uppercase letter`	Missing uppercase letter.
`400`	`Password must contain at least one lowercase letter`	Missing lowercase letter.
`400`	`Password must contain at least one digit`	Missing a number.
`400`	`Password must contain at least one special character`	Missing a special character.
`400`	`Passwords do not match`	`password` and `password_confirmation` don't match.
`409`	`Email already registered`	The given `email` is already in use.
`409`	`Username already taken`	The given `username` is already in use.
`409`	`Mobile number already registered`	The given `mobile_no` is already in use.

Notes

All uniqueness checks (email, username, mobile_no) run in parallel before anything is written, so you get the relevant conflict error without unnecessary account creation attempts.
Password is stored using bcrypt hashing — plaintext passwords are never stored.
If any part of account provisioning fails (main record, team, credits, or permissions), the entire registration is rolled back — no partial accounts are created.
country is optional and stored as-is if provided.