Request a signup link

Sign-up STEP ONE: ask for a verification link. Creates nothing.

There is deliberately no password field. A password supplied here would have to be stored against an address nobody has proved they can read, which is exactly the pre-claim this two-step flow exists to close: the row is later adopted by the real owner's SSO login or invitation with that hash intact, and whoever pre-claimed the address can then sign in as them. The password is chosen in :class:EmailVerificationRequest, after the emailed link comes back.

The ONE answer both link-request endpoints give, whatever the address.

A body that varied by outcome — or a 404 for an unknown address — would turn either endpoint into an account-existence oracle for anyone who can type an email in.