Build integrations · Partner
Tenant signup API
Provision a commercial or enterprise tenant, its first owner, and verification records from an approved partner flow.
The tenant signup endpoint provisions a new organisation and its first responsible user. It is intended for approved partner or internal onboarding flows, not open browser traffic.
POST /api/tenants/signup HTTP/1.1
Host: idms.skyfallen.one
Accept: application/json
Content-Type: application/json
X-Skyfallen-Client-Id: 9f2f0d28-8d32-4c6d-a4af-0b3a82c102f4
X-Skyfallen-Client-Secret: sapp_client_secret
{
"type": "enterprise",
"first_name": "Mavi",
"last_name": "Gökyüzü",
"email": "[email protected]",
"phone": "+442071838750",
"phone_country": "GB",
"bday": 14,
"bmonth": 9,
"byear": 1992,
"country": "GB",
"address_line_1": "24 Foundry Lane",
"address_line_2": "Flat 8",
"city": "London",
"province": "London",
"postcode": "E1 6AN",
"org_country": "GB",
"org_name": "Mavi Şeyler",
"org_legal_name": "Mavi Şeyler Anonim Şirketi",
"org_registration": "12999999",
"org_address_line_1": "1 Meridian House",
"org_address_line_2": "Docklands",
"org_city": "London",
"org_province": "London",
"org_postcode": "E14 5AB",
"org_description": "Enterprise design and production group.",
"est_day": 18,
"est_month": 4,
"est_year": 2020,
"org_website": "maviseyler.com",
"org_duns": "123456789",
"org_use_case": "Identity and workforce provisioning.",
"confirm_authority": true,
"confirm_tos": true,
"confirm_privacy": true,
"confirm_signature": true,
"confirm_legal": true,
"confirm_waiver": true,
"confirm_nda": true
}
{
"status": "success",
"data": {
"user_id": "018fd4c0-e2da-7c7d-8b8e-0f033193b383",
"tenant_id": "018fd4c2-57de-7bc4-8e53-4e5758c0f624",
"tenant_membership_id": "41",
"business_verification_id": "018fd4c1-a695-71c7-b450-b6606a2a6a4c",
"person_verification_id": "018fd4d0-82cb-7497-9bf6-23055ec9ac1a",
"tenant_type": "enterprise",
"password_reset_sent": true,
"secr": "8392014"
}
}
Endpoint
POST /api/tenants/signup
The endpoint is served from the IDMS API host:
Requests require API key credentials. The endpoint is throttled separately from SAPP read endpoints.
https://idms.skyfallen.one/api/tenants/signup
Tenant types
type must be either commercial or enterprise.
Enterprise signup requires additional organisation fields:
Commercial signup accepts those fields as optional.
| Field | Notes |
|---|---|
org_website |
Required for enterprise. Must be a domain value. |
org_duns |
Required for enterprise. Numeric value. |
org_use_case |
Required for enterprise. Minimum 10 characters. |
confirm_waiver |
Required confirmation for enterprise. |
confirm_nda |
Required confirmation for enterprise. |
Person fields
The first user becomes the responsible owner created with the tenant.
The current validation rejects users under 13 years old.
| Field | Notes |
|---|---|
first_name, last_name |
Required strings, minimum 2 characters. |
email |
Required, unique, normalized by ONE before duplicate checks. |
phone, phone_country |
Required phone input used for contact and verification flows. |
bday, bmonth, byear |
Required birth date parts. The date must be valid. |
country |
Required ISO 3166 alpha-2 country code. |
address_line_1, city, province, postcode |
Required personal address fields. |
Organisation fields
Organisation date parts are validated as a real calendar date. Enterprise organisations must have been established for at least one year.
The created tenant also receives verification records. A password reset email code is sent to the created user so they can set their password.
Confirmations
The endpoint requires explicit confirmation fields because the signup creates legal and verification records.
Accepted truthy values include true, 1, "1", "true", "yes", and "Yes".
Validation errors
Validation failures are returned by Laravel as JSON validation errors. A typical duplicate email response looks like this:
{
"message": "The email has already been taken.",
"errors": {
"email": [
"The email has already been taken."
]
}
}
After creation
Use the SAPP read API to retrieve the full tenant or user object after signup. The signup response intentionally returns identifiers and verification references, not the entire profile.