Start a sign-up by mailing a six-digit code to the address

user.signup.request

Hashes the password, holds the sign-up for 15 minutes and mails a six-digit code to the address. No user or company exists until user.signup.verify spends the code, so an address nobody reads never becomes an account. A new request for the same address retires the previous code only when it carries the same password; while a code from another password is live it answers identity_rate_limited. POST /v1/identity/signup without an x-turnstile-token header on a deployment that checks Turnstile runs this operation and answers the same 202. Three codes per address per hour, from one client address three per hour, then identity_rate_limited. Refuses an address that already has an account with the same invalid_credentials user.signup gives, and refuses with capability_not_configured on a deployment with identity mail switched off or unable to queue the code email. The pending sign-up lives in engine memory: an engine restart drops it and the caller asks again.

POST /v1/identity/signup/request

Principal public. Idempotency required. Environment sandbox.

Input

Field	In	Type	Description
`X-Hyperscale-Environment`	header	`sandbox \| live`
`Idempotency-Key` required	header	`string`
`X-Hyperscale-Rehearsal`	header	`"true"`	`true` runs the request through admission and execution, keeps nothing, and answers OperationRehearsal with 200 in place of the operation's own output. Needs a signed-in caller. Identity operations, such as sign-in, sessions, team members and agent grants, refuse it with invalid_request.
`email` required	body	`string`
`password` required	body	`string`
`displayName` required	body	`string`
`mobile`	body	`string`	E.164 mobile number registered with Absher. When omitted, a valid sandbox placeholder is derived from the email, as user.signup does.
`teamName` required	body	`string`	Name for the new company and its team
`country`	body	`string`	ISO 3166-1 alpha-2 country code
`termsAccepted` required	body	`true`	Affirmative acceptance of the Terms of Service, Privacy Policy, and Security terms. The acceptance timestamp is recorded on the user the code creates.

Request sample

curl --request POST 'https://hyperscale0.ai/v1/identity/signup/request' \
  --header "Authorization: Bearer $HYPERSCALE_API_KEY" \
  --header 'X-Hyperscale-Environment: sandbox' \
  --header "Idempotency-Key: $(uuidgen)" \
  --header 'Content-Type: application/json' \
  --data-raw '{"email":"[email protected]","password":"correct-horse-battery","displayName":"Founder Example","teamName":"Example Escrow","termsAccepted":true}'

Errors

Code	HTTP	Cause
`idempotency_conflict`	409	The request reused an Idempotency-Key for a different logical mutation.
`idempotency_required`	400	The operation is a mutation and Hyperscale requires a replay key before executing it.
`internal_error`	500	Hyperscale hit an unexpected server-side condition and hid internal implementation details from this audience.
`invalid_request`	400	The request does not match the API reference.
`not_found`	404	No Hyperscale route matched the requested path and method.
`rate_limited`	429	The credential sent more than its limit in the current 60-second window: 600 requests per API key or session, 1,200 per IP address. Every response carries `x-ratelimit-limit`, `x-ratelimit-remaining` and `x-ratelimit-reset` (Unix seconds).
`request_body_too_large`	413	The JSON request body exceeded Hyperscale's accepted payload size.
`resource_not_found`	404	The requested resource does not exist in the credential's visible scope.
`state_conflict`	409	The operation conflicts with the current durable state of the resource.
`state_constraint_failed`	422	The request is syntactically valid but violates a business-state constraint.
`tenant_not_found`	404	The credential resolved to a tenant Hyperscale cannot find.
`unauthorized`	403	The request did not include a valid Hyperscale bearer credential for this environment.
`capability_not_configured`	400	This deployment lacks something the request depends on. The requested capability is not in the commercial catalog, identity email delivery is off (`details.capability` is `identity_email`), the deployment names no organization verification provider (`details.capability` is `organization_verification` and `details.configKey` names the setting), or a named provider has no live adapter (`details.provider` names it).
`identity_rate_limited`	429	The mailed-code signup refused: this address or client address asked for three codes in the past hour, or the code took five wrong guesses and was retired.
`instrument_instance_not_found`	404	No record of this instrument matches the `instanceId` in this Product, company and environment. `details.instrumentId` and `details.instrumentInstanceId` name what was looked up.
`invalid_credentials`	401	Hyperscale could not accept the account or credential request. Signup, login, and bearer authentication use one 401 for every case they reject, so the response exposes no credential-specific reason or registered-email verdict. The single exception is a key that is real but homed in the other environment: because the presented secret already matched a stored key, the message names the mismatch instead of leaving a working credential looking unknown. A bearer that matched nothing gets text that fits its prefix (an agent token, a refresh token, a personal access token, a session or no Hyperscale token at all), which says only what the caller sent, never whether a credential like it exists.
`operation_not_finalized`	409	The operation in `details.operationId` has started but has no final receipt. It is still running, or its outcome is unknown after a failure past the point where it may have committed. `details.error` carries the underlying failure when there is one.

All operations