Registration Policy Update Rbac Endpoints

Update Registration Policy

PUT /v1/endpoints/{uuid}/rbac/registration-policy

Change how new RBAC clients can join the endpoint. Effect is immediate — the next sign-up attempt is evaluated against the new policy. Existing clients are unaffected (suspending or removing them is a separate action via /status / DELETE .../rbac/clients/{client_uuid}).

Setting invite_only: true or allow_self_registration: false stops new self-registrations. Sessions for already-registered clients keep working until expiry. To force them out, use revoke-all per client (no bulk-revoke-everyone API right now).

Path parameters

uuid string (uuid) Req

The endpoint's uuid from /endpoints.

Request body

All fields are optional; omitted booleans default to false. The whole policy is replaced on each save (it is not a partial merge of individual flags).

allow_self_registration boolean

Allow users to self-register.

invite_only boolean

Require a valid invite token to register. The invite is the owner's approval: a redeemed invite is active at once (after the email confirmation when require_email_verification is on), whatever auto_approve says.

auto_approve boolean

Activate new self-registered clients immediately.

require_email_verification boolean

Require email verification before activation.

default_role_uuid string (uuid)

The uuid of the role to assign to newly self-registered clients. Must be one of this endpoint's roles.

allowed_domains string[]

Restrict registration to these email domains. Empty = no restriction.

blocked_domains string[]

Email domains to reject.

oauth_providers string[]

Restrict OAuth-based auto-registration to these provider types. Empty = all configured providers allowed.

password_requirements object

Password complexity rules:

{"min_length": 8, "require_uppercase": true, "require_lowercase": true, "require_numbers": true, "require_special": false}

forwarding_config object

Headers/cookies to inject toward the backend after authentication (e.g. forward_user_email, custom_headers).

Deprecated: default_role_id (integer) is still accepted until the sunset. Send default_role_uuid; sending both for different objects is a 400 id_uuid_mismatch.

Response (200 OK)

A confirmation object — not the updated policy. Re-read it via GET /v1/registration-policy if you need the saved values.

success boolean

true on a successful save.

message string

"Registration policy updated successfully".

Errors

400 Bad Request

Malformed JSON request body, a malformed default_role_uuid (default_role_uuid must be a uuid), both forms naming different roles (id_uuid_mismatch), or an integer after the sunset (integer_id_unsupported).

401 Unauthorized

Missing auth.

403 Forbidden

Caller lacks the endpoints:update permission in the active account.

404 Not Found

Endpoint doesn't exist or doesn't belong to the calling account, or default_role_uuid isn't one of this endpoint's roles (default_role_uuid not found; a legacy default_role_id of another endpoint is refused the same way).

Request — switch to invite-only
curl -X PUT "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/registration-policy" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "allow_self_registration": true,
    "invite_only": true,
    "oauth_providers": ["google"]
  }'

Request — domain-restricted open
curl -X PUT "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/registration-policy" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "allow_self_registration": true,
    "invite_only": false,
    "auto_approve": true,
    "default_role_uuid": "019b5fc1-0eb5-7dd8-a0e9-a575428f890d",
    "allowed_domains": ["acme.com", "acme.co.uk"]
  }'

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
client._put_raw(
    "/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/registration-policy",
    {"allow_self_registration": True, "invite_only": True},
)

Response — 200 OK
{
  "success": true,
  "message": "Registration policy updated successfully"
}

Was this helpful?

PreviousGet Registration Policy NextList Routing Rules

On this page

Update Registration Policy

Was this helpful?