Complete End User Registration with Wallets

Completes the end user registration process and creates the user’s initial credentials along with delegated wallets for the new end user.

All credentials submitted in this call (firstFactorCredential, secondFactorCredential, recoveryCredential) sign the same challenge returned by the registration init endpoint (Create Delegated Registration Challenge or Create Social Registration Challenge).

Always include a recoveryCredential. Without one, a user who loses their device cannot recover access and you must initiate a delegated recovery manually. See Implement end-user recovery.

The type of credentials being registered is determined by the credentialKind field in the nested objects (firstFactorCredential , secondFactorCredential and recoveryCredential). Supported credential kinds are:

• Fido2: User action is signed by a user’s signing device using WebAuthn.
• Key: User action is signed by a user’s, or token’s, private key.
• PasswordProtectedKey: User action is signed by a user’s, or token’s, private key. The encrypted version of the private key is stored by Dfns and returns during the signing flow for the user to decrypt it.
• RecoveryKey: Similar to PasswordProtectedKey, but this credential can only be used to recover an account, not to sign an action or login. Once this credential is used, all the other user’s credentials are invalidated.

The number of delegated wallets created and the wallet types are determined by the wallets specifications. The end user is automatically assigned ManagedDefaultEndUserAccess managed permission that grants the end user full access to the wallets.