PATIENT_REGISTRATION_ENABLED

Controls whether patients can create their own account in the project. Turn it off for invitation-only patient onboarding.

Type	Boolean setting
Change with	PUT /v1/project/settings/PATIENT_REGISTRATION_ENABLED
Who can change it	Project admin
When unset	Registration is on if the project has a default patient AccessPolicy, although GET /v1/project/settings reports false
Set on new projects	false for child projects created with POST /v1/slim/project/child; not set by any other project-creation route
Needs	defaultPatientAccessPolicy on the project
Inherited	No. A child project reads only its own value and its own default patient AccessPolicy.

Turn patient registration off

curl --request PUT \
  --url 'https://api.sandbox.ovok.com/v1/project/settings/PATIENT_REGISTRATION_ENABLED' \
  --header "Authorization: Bearer ${OVOK_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{"enabled":false}'

What registration needs

A patient who registers gets the project's default patient AccessPolicy. Without one, registration is refused whatever this switch says. The defaultPatientAccessPolicy field belongs to the project itself; there is no project-settings endpoint for it, and no project-creation route sets it for you.

Where the switch applies

Route	Checked?
POST /auth/tenant/Patient/register	Yes
POST /auth/signup with resourceType Patient (deprecated)	Yes
First sign-in with Google or Apple	No
POST /auth/invite with type Patient	No. See PATIENT_INVITATION_ENABLED.

What callers see

POST /auth/tenant/Patient/register runs its checks in this order:

Order	Condition	Status	Message
1	Too many requests (5 per minute per client address)	429
2	Unknown tenant code	404	Tenant not found.
3	The project has no default patient AccessPolicy	403	Registration is not enabled for this project.
4	The switch is off	403	Registration is not enabled for this project.
5	A patient with this email already exists in the project	400	Registration failed.

On success the response contains tokens, so the new patient is signed in immediately.

Business-email sign-ups

When CLINICIAN_INVITE_ON_BUSINESS_EMAIL is on, a patient registration with a business address creates a practitioner invitation instead of a patient and returns {"nextStep":"clinician-invite"} with no tokens. If the project cannot send that invitation, the person is registered as a patient, silently.

Gotchas

• Off and "not configured" look the same. Steps 3 and 4 return the same 403 and message. If you did not turn the switch off, check the default patient AccessPolicy first.
• GET shows false for a project that has never set it, but registration works whenever the AccessPolicy exists. Set the key to the value you intend.
• Projects created with POST /v1/slim/project/child start with it off, and have no default patient AccessPolicy until someone sets one.
• Turning it off is not enough to stop patient sign-up. Two other routes create patients: POST /auth/invite (no sign-in required, while PATIENT_INVITATION_ENABLED is on) and first-time Google or Apple sign-in. Turn the invitation switch off too, and test social sign-in if your app offers it.
• A successful registration returns tokens even when PATIENT_LOGIN_ENABLED is false.
• Social sign-up creates a patient with no AccessPolicy. Do not rely on this switch to scope what such a patient can see.
• Every error is padded to at least one second, so do not treat a slow failure as an outage.

Related

• Patient registration, the flow this switch controls
• Set up your project
• PATIENT_LOGIN_ENABLED
• PATIENT_INVITATION_ENABLED
• PRACTITIONER_REGISTRATION_ENABLED