Get Registration Policy
Read the current registration policy for an endpoint — how new RBAC clients can join. The policy is a set of boolean toggles plus domain/role/password constraints rather than a single enum:
allow_self_registration— whenfalse, no self-registration at all; admins must create clients via API.invite_only— registration is gated; users need an invite link to join.auto_approve— new clients become active immediately rather than waiting for admin approval. Withinvite_only: trueit doesn't apply to invites: the invite is the approval.
When no policy has been saved yet, the endpoint returns the safe defaults invite_only: true, auto_approve: false, and the default password requirements.
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.Response (200 OK)
allow_self_registration boolean
Whether users can self-register at all.
invite_only boolean
Registration requires a valid invite token.
auto_approve boolean
New self-registered clients become active immediately.
require_email_verification boolean
New clients must verify their email before activation.
default_role_uuid string (uuid) | null
The
uuid of the role assigned to newly self-registered clients, if set.allowed_domains string[] | null
Restrict registration to these email domains (e.g.
["example.com"]). Empty or null (never set) = no restriction.blocked_domains string[] | null
Email domains that are rejected from registering.
null when never set.oauth_providers string[] | null
Which OAuth providers (by
provider_type) may auto-register new clients on first login. Empty or null (never set) = all configured providers.forwarding_config object | null
Headers/cookies to inject toward the backend after authentication (e.g.
forward_user_email, custom_headers).password_min_length int
Minimum password length for username/password self-registration.
password_require_uppercase boolean
Require at least one uppercase letter.
password_require_lowercase boolean
Require at least one lowercase letter.
password_require_numbers boolean
Require at least one digit.
password_require_special boolean
Require at least one special character.
Deprecated: until the sunset this response also carries the legacy integer default_role_id. Don't use it; read default_role_uuid.
Errors
401 Unauthorized
Missing auth.
404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
Request
curl "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/registration-policy" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
policy = client._get_raw(
"/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/registration-policy"
)
print(policy["allow_self_registration"], policy["invite_only"])
Response — 200 OK
{
"allow_self_registration": true,
"invite_only": true,
"auto_approve": false,
"require_email_verification": false,
"default_role_uuid": "019b5fc1-0eb5-7dd8-a0e9-a575428f890d",
"allowed_domains": ["example.com"],
"blocked_domains": [],
"oauth_providers": ["google"],
"forwarding_config": null,
"password_min_length": 8,
"password_require_uppercase": true,
"password_require_lowercase": true,
"password_require_numbers": true,
"password_require_special": false
}
Was this helpful?