Complete Onboarding
POST
/auth/user/me/onboarding/complete
Sets first_time=false. Optional acquisition/business/privacy persist when module schema is installed. Re-callable upsert. Acquisition is write-only (not returned on GET). Prefer /auth/user/me/privacy* for post-wizard GDPR/CCPA. Rate-limited via Ultra (10 / 10 min).
Authorizations
SessionAuth
Session ID for authenticated requests
Type
API Key (header: X-Session-ID)
Request Body
application/json
JSON "acquisition_channel": "string", "acquisition_source": "string", "acquisition_detail": "string", "team_size_range": "string", "is_business": true, "biz_name": "string", "biz_country": "string", "biz_state": "string", "biz_position": "string", "biz_postal_code": "string", "gdpr_consent": true, "gdpr_consent_version": "string", "ccpa_applies": true, "ccpa_opt_out": true, "privacy_region": "string"
{
}
Responses
Onboarding completed
application/json
JSON "success": true, "message": "string", "data": { "first_time": false, "updated_at": "string", "optional_fields_persisted": true }
{
}
Finish first-run onboarding and optionally persist acquisition / business / privacy fields.
Path: POST /auth/user/me/onboarding/complete
Auth: session. Rate limit: Ultra 10 / 10 minutes per IP.
This route belongs to the Onboarding module family. Related components:
- Business / Business operations — company profile (
ext-business) - Privacy / Privacy operations — GDPR/CCPA (
ext-privacy)
Acquisition fields are write-only (not returned on GET). Prefer privacy routes for post-wizard GDPR/CCPA and Business API / PUT /auth/user/me for later biz updates.
Notes
- Idempotent / re-callable upsert.
- Missing module columns → still completes with
optional_fields_persisted: false. - Read biz/privacy via Get current user or Get privacy.