Rendering the right sign-up form

Signing up

Before showing any sign-up UI, the client asks which registration methods are live so it renders an email form, a phone form, or both.

GET /v1/auth/registration-policy → { allowedMethods, combinationMode } — render the matching form(s)

GET/v1/auth/registration-policypublicGet active registration policy

Read-only and lightly cached (max-age=30) — safe on page load. Both methods are live by default since migration 0038 ({email, phone}), and the policy is GLOBAL. combinationMode is ENFORCED: link (default) = register with one method and add the other later (scenario 4); atomic = one sign-up must carry and verify BOTH (scenario 5), and every single-channel entrypoint then answers 403 registration_combination_required. It is inert unless allowedMethods holds both methods. Gates sign-up only — login and /v1/me credential linking ignore it. The write path lives on the operator profile (scenario 39).

ℹ︎Field guide — what each value means & where it comes fromno inputs

No request body, path params, query params, or required headers. This is a public, unauthenticated, read-only endpoint — no Authorization or x-gateway-context is required either. It returns the active self-registration policy (allowedMethods and combinationMode) so the sign-up UI can render the correct form.

→ GET https://api.kerja.team/v1/auth/registration-policy

↩︎Response guide — what comes back & what each value means4 fields

200 OK returning the standard { data } envelope; body is the active self-registration policy (no secrets, no user data). Response header Cache-Control: public, max-age=30 (lightly cacheable). If the policy row is missing it defaults to { allowedMethods: ["email"], combinationMode: "link" }.

dataobjectalways

Envelope wrapper holding the active self-registration policy the unauthenticated sign-up UI uses to render the correct form.

data.allowedMethodsarrayalways

The identifier methods the sign-up form may offer; a subset of ["email","phone"]. The client renders one input per listed method. Defaults to ["email"] when the policy row is missing.

data.allowedMethods[]enumalways

An allowed registration identifier method. Each value tells the UI which credential input to render.

email — Sign-up may use an email address (render the email field).
phone — Sign-up may use a phone number (render the phone field / OTP flow).

data.combinationModeenumalways

How the allowed methods combine during sign-up; drives whether the form collects one identifier or both at once. Defaults to "link" when the policy row is missing.

link — Default — register with a single method now and add the second method later under /v1/me.
atomic — A single register call must carry both methods together.