Appearance
Registration Policy
Platform admins control which email domains can register new lab tenants. This reduces spam signups and ensures only legitimate businesses onboard.
Registration email policy
Configure at Admin Portal → Settings → Registration or via API:
| Method | Endpoint |
|---|---|
| GET | /admin/settings/registration-email-policy |
| PUT | /admin/settings/registration-email-policy |
Requires platform.tenants.manage permission.
Policy fields
| Field | Type | Description |
|---|---|---|
allowDisposableEmails | boolean | Master switch for disposable email providers |
disposableListMode | string | blacklist or whitelist |
disposableDomains | string[] | Domain list for the selected mode |
How validation works
During POST /auth/register, the email domain is checked:
| Mode | allowDisposableEmails | Behavior |
|---|---|---|
| Blacklist | false | Block if domain is in disposableDomains |
| Blacklist | true | Allow all domains |
| Whitelist | any | Only allow domains in disposableDomains |
Default policy blocks common disposable providers (mailinator, guerrillamail, etc.).
Example configurations
Block all disposable emails (recommended)
json
{
"allowDisposableEmails": false,
"disposableListMode": "blacklist",
"disposableDomains": ["mailinator.com", "tempmail.com"]
}Enterprise-only registration
json
{
"allowDisposableEmails": false,
"disposableListMode": "whitelist",
"disposableDomains": ["hospital.pk", "diagnostics.com"]
}Open registration (development)
json
{
"allowDisposableEmails": true,
"disposableListMode": "blacklist",
"disposableDomains": []
}Error messages
Blocked registrations return HTTP 400 with a clear message indicating the email domain is not permitted. The UI should guide users to use a business email.
Interaction with email verification
Registration policy is enforced before account creation. Email verification (OTP or link) is a separate step — see Login & Registration.
| Control | When applied |
|---|---|
| Domain policy | Registration |
| Email OTP | Post-registration verification |
| Platform admin invite | Bypasses self-registration |
Operator-created tenants
Platform admins creating tenants via Tenant Management are not subject to the self-registration email policy. The owner email is set directly.