- Shipped
- April 24, 2026 at 12:36 AM UTC
- Author
- Kamo
- Commit
- 3a2d32c
The /api/security/register endpoint previously rejected any request missing email, first name, or last name. That made the under-13 path (KIDS_ONLY orgs, or ALL_AGES with a sub-13 registrant) impossible — those accounts legitimately have only an alias + password + seed phrase. Validation now requires alias + password on every path, and treats email + first name + last name as an all-or-nothing triple: supplying any one of them requires all three. The verification-email send and the response email field now guard on whether an email was actually provided, and the response status is "REGISTERED" (vs the existing "EMAIL_VERIFICATION_REQUIRED") when there is no email to verify.