Onboarding API
First-run completion and optional acquisition / business / privacy fields on users.
Canonical mount: /auth/user/me/* (not /api/user).
Onboarding is the parent of Business (ext-business) and Privacy (ext-privacy).
Ownership matrix
| Capability | Path | Notes |
|---|---|---|
| Complete wizard + acquisition upsert | POST /auth/user/me/onboarding/complete | Sets first_time=false; may upsert biz/privacy |
| Update business profile | PUT /auth/user/me | is_business, biz_* incl. biz_postal_code — Business API |
| Privacy GDPR/CCPA/region | /auth/user/me/privacy* | Privacy API |
| Read profile (biz + privacy, no acquisition) | GET /auth/user/me | |
| Read privacy only | GET /auth/user/me/privacy |
Acquisition (acquisition_*, team_size_range) is write-only via complete — never returned on GET.
Complete (upsert)
http
POST /auth/user/me/onboarding/complete
Content-Type: application/json
X-Session-ID: <session>Ultra rate limit: 10 / 10 minutes per IP.
Minimal: {} — only sets first_time=false.
Full wizard may include acquisition, biz, and privacy fields. Prefer dedicated privacy routes and business PUT after first run.
Admin analytics
See Admin API: acquisition breakdown/funnel, list filters, privacy override.