Create Delegated Registration Challenge
Registers a new End User in your organization and returns a registration challenge, without sending a Dfns registration email. Use this when your application owns the authentication system and you want delegated signing under your brand.
The response includes:
- A new
EndUserattached to your organization. - A registration challenge plus a
temporaryAuthenticationTokento authenticate the next call.
Pass the challenge to your frontend so the user can create a passkey, then call Complete User Registration or Complete End User Registration with Wallets with that challenge signed.
Bundle a recoveryCredential in the completion call alongside the first passkey. All credentials in that call sign the same challenge returned here. See Implement end-user recovery.
Authentication
❌ Organization User (CustomerEmployee)❌ Delegated User (
EndUser)✅ Service Account
Required Permissions
Auth:Register:Delegated: Always required.Authorizations
Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows
User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows
Body
Username/identifier (any unique string accepted, e.g. your internal user ID or email).
1Must be EndUser.
EndUser Optional external identifier for the user, used for cross-referencing with your own systems.
1Response
Success
JWT used to identify the registration session when calling Complete User Registration.
Challenge to be signed by the credential being registered.
Credential kinds that can be used to register the user.
Identifies the information needed to verify the user's signing certificate; can be one of the following:
- none: indicates no attestation data is required
- indirect: indicates the attestation data should be given, but that it can be generated using an Anonymization CA
- direct: indicates the attestation data must be given and should be generated by the authenticator
- enterprise: indicates the attestation data should include information to uniquely identify the user's device
none, indirect, direct, enterprise Public key credential parameters supported for the registration.
Credentials to exclude from the registration (already registered for the user).
URL to provision a TOTP credential, when applicable.
Deprecated. Should not be used.