Create Delegated Registration Challenge
Registers a new End User in your organization and returns a registration challenge, without sending a Dfns registration email. Use this when your application owns the authentication system and you want delegated signing under your brand.
The response includes:
- A new
EndUserattached to your organization. - A registration challenge plus a
temporaryAuthenticationTokento authenticate the next call.
Pass the challenge to your frontend so the user can create a passkey, then call Complete User Registration or Complete End User Registration with Wallets with that challenge signed.
Bundle a recoveryCredential in the completion call alongside the first passkey. All credentials in that call sign the same challenge returned here. See Implement end-user recovery.
Documentation Index
Fetch the complete documentation index at: https://docs.dfns.co/llms.txt
Use this file to discover all available pages before exploring further.
Authentication
❌ Organization User (CustomerEmployee)❌ Delegated User (
EndUser)✅ Service Account
Required Permissions
Auth:Register:Delegated: Always required.Authorizations
Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows
User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows
Body
Response
Success
Identifies the information needed to verify the user's signing certificate; can be one of the following:
- none: indicates no attestation data is required
- indirect: indicates the attestation data should be given, but that it can be generated using an Anonymization CA
- direct: indicates the attestation data must be given and should be generated by the authenticator
- enterprise: indicates the attestation data should include information to uniquely identify the user's device
none, indirect, direct, enterprise 