Skip to main content

Signup Check

POST 
/api/v1/public/signup-check

Vet a sign-up form BEFORE the browser creates the Cognito identity.

The sign-up form talks to Cognito directly, so until 2026-09-23 a throwaway address got a verified login and only met the refusal at org creation — leaving an orphan identity and a confused person. The form now asks here first. Two answers:

  • a temporary-inbox address (is_disposable) → ok=false, hard: the same rule bootstrap-org enforces, so bypassing this call gains nothing;
  • a probe-shaped form (name/company like "test", "john smith", plus another tell) → ok=false with a request for the real name and company. This one is form-only; bootstrap-org still accepts it and flags the org instead, so a real business that trips it can always get through.

Unauthenticated by nature; covered by the per-IP edge rate limiter. Answers ok=true on any internal failure — the form must never be blocked by us.

Request​

Responses​

Successful Response