---
title: "Register a new user"
method: POST
path: "/users/register"
tags: ["Users"]
---

# Register a new user

`POST /users/register`

Creates a new user account. Requires a valid registration JWT (set by registerJWT middleware).
Validates email uniqueness, password strength, and required fields.
Marks any pending invitation as accepted after successful creation.

## Request body

- object
  - `name` string, required — User's first name
  - `surname` string, required — User's last name
  - `email` string, email, required
  - `password` string, password, required — Must be 8+ chars with uppercase, lowercase, and digit
  - `roleId` integer, required — 1=Admin, 2=Reviewer, 3=Editor, 4=Auditor
  - `organizationId` integer, required — Organization to assign the user to

## Response `201`

User created successfully

- object
  - `message` string
  - `data` UserSafe — User object with password_hash excluded
    - `id` integer, required
    - `name` string, required
    - `surname` string, required
    - `email` string, email, required
    - `role_id` integer, required — 1=Admin, 2=Reviewer, 3=Editor, 4=Auditor, 5=SuperAdmin
    - `createdAt` string, date-time, required
    - `last_login` string, date-time, nullable
    - `updatedAt` string, date-time
    - `is_demo` boolean
    - `organization_id` integer, nullable
    - `profile_photo_id` integer, nullable
    - `sso_provider` 'AzureAD' | 'null', nullable
    - `sso_user_id` string, nullable

## Other responses

- `400` — Validation error (missing fields, weak password, invalid email)
- `403` — Business logic error
- `409` — User with this email already exists
- `500` — Internal server error

## Changes

- **2026-08-26** `3b138b306b5b` — 2 breaking, 1 warning, 4 info
  - the response property `data/last_login` became nullable for the status `201`
  - removed the required property `data/created_at` from the response with the `201` status
  - removed the optional property `data/updated_at` from the response with the `201` status
  - added the optional property `data/sso_provider` to the response with the `201` status
  - …3 more
- **2026-07-13** `d86d0bf8bebe` — 4 info
  - api operation id `createNewUser` was added
  - the endpoint scheme security `bearerAuth` was removed from the API
  - api tag `Users` added
  - api tag `Users - Registration` removed
- **2026-07-13** `655215fe8c81` — 4 info
  - api operation id `createNewUser` removed and replaced with ``
  - the endpoint scheme security `bearerAuth` was added to the API
  - api tag `Users - Registration` added
  - api tag `Users` removed
- **2026-06-22** `5878ba786a89` — 4 info
  - api operation id `createNewUser` was added
  - the endpoint scheme security `bearerAuth` was removed from the API
  - api tag `Users` added
  - api tag `Users - Registration` removed
- **2026-04-21** `55cdc040840c` — 7 breaking, 8 info
  - added the new required request property `email`
  - added the new required request property `name`
  - added the new required request property `organizationId`
  - added the new required request property `password`
  - …11 more

[Full history](https://skmtc.dev/verifywise-ai/apis/verifywise-api/changes/users/register/post.md)

---

[API](https://skmtc.dev/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.dev/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/revisions/3b138b306b5b/schema)