> ## Documentation Index > Fetch the complete documentation index at: https://api-portal.etoro.com/llms.txt > Use this file to discover all available pages before exploring further. # Partner registers a new eToro user > **Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget. --- Registers a user on behalf of the partner. No password is supplied; eToro generates one. The synchronous response includes a user-scoped token bundle (access token, plus an ID token for the registration flow) issued by sts-idp with claims scoped by the SSO client_id resolved from X-ClientId, so the partner can chain the rest of the flow without an interactive login. ## OpenAPI ````yaml /api-reference/partners-openapi.json post /api/v1/registration/users openapi: 3.0.1 info: title: eToro Api version: v1.342.0 description: >- eToro’s public API provides access to real-time financial data, trading insights, and account management features, allowing developers to integrate eToro’s services into their applications. With access to market prices, historical data, and social trading information, the API empowers users to enhance their trading strategies. Designed for security and scalability, the eToro API ensures smooth and reliable integration for a variety of financial applications. For more details on integrating with eToro's public WebSocket service, please refer to the dedicated [WebSocket documentation](./websocket/websocket-doc.html). ## Authentication Every request must be authenticated with exactly one of two options: an OAuth 2.0 access token (`Authorization: Bearer `), or the non-interactive credential pair (`x-api-key` + `x-user-key` headers). The two options are mutually exclusive — a request carrying both is rejected. Each operation lists the OAuth scopes that grant access as alternative security requirements: a bearer token needs only ONE of them, and the same permissions govern the credential pair. servers: - url: https://public-api.etoro.com description: eToro Public API - Partners security: - apiKeyAuth: [] userKeyAuth: [] - oauth2: [] tags: - name: OPS - name: KYC - name: Cash Accounts - name: FTD - name: Crypto Deposit - name: Crypto Withdrawals - name: Registration - name: Sub-Accounts - name: Email Verification - name: Trusted Partner - name: Phone Verification - name: Verification paths: /api/v1/registration/users: post: tags: - Registration summary: Partner registers a new eToro user description: >- **Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget. --- Registers a user on behalf of the partner. No password is supplied; eToro generates one. The synchronous response includes a user-scoped token bundle (access token, plus an ID token for the registration flow) issued by sts-idp with claims scoped by the SSO client_id resolved from X-ClientId, so the partner can chain the rest of the flow without an interactive login. operationId: registerPartnerUser parameters: - example: f47ac10b-58cc-4372-a567-0e02b2c3d479 name: X-Request-Id in: header schema: type: string format: uuid required: true requestBody: content: application/json: schema: $ref: '#/components/schemas/RegistrationRegisterUserByPartnerRequest' example: countryIso: GB consents: - signedAt: '2026-05-27T12:00:00Z' documentId: 42 clientIp: 1.2.3.4 languageIso: en-gb username: partneruser01 email: user@example.com partnerCorrelationId: partner-ref-001 required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/RegistrationRegisterUserByPartnerResponse' example: success: true data: username: partneruser01 loginSucceeded: true partnerCorrelationId: partner-ref-001 loginInfo: {} description: >- User registered successfully. The loginSucceeded field indicates whether auto-login succeeded after registration. headers: RateLimit-Limit: description: >- Maximum number of requests allowed per window. This is the default shared pool used by every endpoint without a dedicated limit, so it is NOT per-endpoint — requests across those endpoints all draw from this one budget. schema: type: integer example: 60 RateLimit-Remaining: description: Requests remaining in the current window for this quota. schema: type: integer RateLimit-Reset: description: Seconds until the current window resets. schema: type: integer RateLimit-Policy: description: Quota policy in the form `;w=`. schema: type: string example: 60;w=60 '400': content: application/json: schema: $ref: '#/components/schemas/RegistrationErrorResponse' examples: InvalidUsername: summary: Username out of length bounds value: error: field: Username message: username must be between 4 and 20 characters code: InvalidUsername value: ab success: false InvalidConsent: summary: Invalid consent item value: error: field: Consents message: each consent must have a valid numeric documentId code: InvalidConsent success: false ConsentsRequired: summary: No consents provided value: error: field: Consents message: consents must contain at least one item code: ConsentsRequired success: false InvalidEmail: summary: Invalid email format value: error: field: Email message: >- email is required, must be a valid email address, and must not exceed 255 characters code: InvalidEmail value: not-an-email success: false description: >- Validation error. Error codes: RequestIdRequired, InvalidUsername, InvalidEmail, InvalidCountryIso, ConsentsRequired, InvalidConsent. '401': content: application/json: schema: $ref: '#/components/schemas/RegistrationErrorResponse' example: error: code: Unauthorized message: Partner is not authorized. success: false description: 'Unauthorized partner. Error code: Unauthorized.' '403': content: application/json: schema: $ref: '#/components/schemas/RegistrationErrorResponse' example: error: code: CountryBlocked message: Registration is not available for this country. success: false description: 'Country blocked. Error code: CountryBlocked.' '409': content: application/json: schema: $ref: '#/components/schemas/RegistrationErrorResponse' examples: IdentifierAlreadyUsed: summary: Partner correlation ID already used value: error: code: IdentifierAlreadyUsed message: >- The partner correlation identifier has already been used. success: false UsernameTaken: summary: Username already taken value: error: code: UsernameTaken message: The username is already taken. success: false EmailTaken: summary: Email already registered value: error: code: EmailTaken message: >- The email address is already associated with an eToro account. success: false description: >- Conflict. Error codes: EmailTaken, UsernameTaken, IdentifierAlreadyUsed. '422': content: application/json: schema: $ref: '#/components/schemas/RegistrationErrorResponse' example: error: field: CountryIso message: Country ISO code is not recognized. code: InvalidCountryIso value: XX success: false description: 'Country not recognized. Error code: InvalidCountryIso.' '429': description: >- Too Many Requests — the shared rate limit (60 requests / 60s) was exceeded. headers: RateLimit-Limit: description: >- Maximum number of requests allowed per window. This is the default shared pool used by every endpoint without a dedicated limit, so it is NOT per-endpoint — requests across those endpoints all draw from this one budget. schema: type: integer example: 60 RateLimit-Remaining: description: Requests remaining in the current window for this quota. schema: type: integer RateLimit-Reset: description: Seconds until the current window resets. schema: type: integer RateLimit-Policy: description: Quota policy in the form `;w=`. schema: type: string example: 60;w=60 Retry-After: description: Seconds to wait before retrying. schema: type: integer example: 60 security: - apiKeyAuth: [] userKeyAuth: [] - oauth2: - etoro-public:partner:registration:write components: schemas: RegistrationRegisterUserByPartnerRequest: properties: countryIso: maxLength: 3 description: ISO 3166 country code (2-3 characters). example: GB minLength: 2 type: string consents: description: Regulation documents the user consented to. items: $ref: '#/components/schemas/RegistrationPartnerConsentItem' type: array languageIso: description: BCP 47 locale code for the preferred language. Optional. example: en-gb type: string username: maxLength: 20 description: Desired username for the new account (4-20 characters). example: partneruser01 minLength: 4 type: string email: maxLength: 255 example: user@example.com format: email description: Email address for the new account (max 255 characters). type: string regionIsoCode: description: Optional sub-national region ISO code (e.g. US-TX for Texas). example: US-TX type: string partnerCorrelationId: maxLength: 100 description: Partner-supplied correlation identifier (max 100 characters). example: partner-ref-001 type: string description: Request body for partner user registration. type: object required: - username - email - countryIso - consents RegistrationRegisterUserByPartnerResponse: properties: success: description: Whether the registration succeeded. example: true type: boolean data: $ref: '#/components/schemas/RegistrationRegisterUserByPartnerResponseData' description: Partner user registration response envelope. type: object RegistrationErrorResponse: properties: error: $ref: '#/components/schemas/RegistrationErrorDetails' success: type: boolean description: Always false for error responses. example: false description: Standard error response envelope. type: object RegistrationPartnerConsentItem: properties: signedAt: example: '2026-05-27T12:00:00Z' format: date-time description: ISO 8601 datetime when the user signed the consent document. type: string documentId: description: Regulation document identifier the user consented to. example: 42 type: integer clientIp: description: End-user IPv4 address at time of consent. example: 1.2.3.4 type: string description: Partner consent item referencing a regulation document. type: object required: - documentId - signedAt - clientIp RegistrationRegisterUserByPartnerResponseData: properties: username: description: Registered eToro username. example: partneruser01 type: string loginSucceeded: description: Whether auto-login succeeded after registration. example: true type: boolean partnerCorrelationId: description: Partner-supplied correlation identifier echoed back. example: partner-ref-001 type: string loginInfo: type: object description: >- STS login information when login succeeded. Contains access token, ID token, and related claims. description: Partner user registration result payload. type: object RegistrationErrorDetails: properties: field: description: Field that caused the error (optional). example: CountryIso type: string message: description: Human-readable error message. example: countryIso must be a 2-3 character ISO 3166 code type: string code: description: Machine-readable error code. example: InvalidCountryIso type: string details: type: string description: Additional error details (optional). value: description: Value that caused the error (optional). example: INVALID description: Error details. type: object required: - code - message securitySchemes: apiKeyAuth: type: apiKey in: header name: x-api-key description: >- API key of the application. Only valid together with the x-user-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. The pair is granted the same permissions the operation's OAuth scopes describe. Demo credential for trying the API from these docs: `lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663` x-default: lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663 userKeyAuth: type: apiKey in: header name: x-user-key description: >- User-specific authentication key. Only valid together with the x-api-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. Demo credential for trying the API from these docs: `eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_` x-default: >- eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_ oauth2: type: oauth2 description: >- eToro OAuth2 — send the access token as `Authorization: Bearer `. Each operation lists the scopes that grant access as separate `security` requirements (OpenAPI OR semantics): the caller's token only needs ONE of them — you do NOT need all of them. Mutually exclusive with the x-api-key/x-user-key credential pair: never send both. flows: authorizationCode: authorizationUrl: '' tokenUrl: '' scopes: etoro-public:demo:read: Grants access to the 'etoro-public:demo:read' scope. etoro-public:kyc:answers:read: Grants access to the 'etoro-public:kyc:answers:read' scope. etoro-public:kyc:answers:write: Grants access to the 'etoro-public:kyc:answers:write' scope. etoro-public:kyc:questions:read: Grants access to the 'etoro-public:kyc:questions:read' scope. etoro-public:kyc:read: Grants access to the 'etoro-public:kyc:read' scope. etoro-public:kyc:regulations:read: Grants access to the 'etoro-public:kyc:regulations:read' scope. etoro-public:kyc:write: Grants access to the 'etoro-public:kyc:write' scope. etoro-public:money.accounts:read: Grants access to the 'etoro-public:money.accounts:read' scope. etoro-public:money.accounts:write: Grants access to the 'etoro-public:money.accounts:write' scope. etoro-public:money.deposit.crypto:read: >- Grants access to the 'etoro-public:money.deposit.crypto:read' scope. etoro-public:money.deposit.crypto:write: >- Grants access to the 'etoro-public:money.deposit.crypto:write' scope. etoro-public:money.ftd:read: Grants access to the 'etoro-public:money.ftd:read' scope. etoro-public:money.ftd:write: Grants access to the 'etoro-public:money.ftd:write' scope. etoro-public:money.withdraw.crypto:read: >- Grants access to the 'etoro-public:money.withdraw.crypto:read' scope. etoro-public:money.withdraw.crypto:write: >- Grants access to the 'etoro-public:money.withdraw.crypto:write' scope. etoro-public:partner-default: Grants access to the 'etoro-public:partner-default' scope. etoro-public:partner:registration:read: >- Grants access to the 'etoro-public:partner:registration:read' scope. etoro-public:partner:registration:write: >- Grants access to the 'etoro-public:partner:registration:write' scope. etoro-public:real:read: Grants access to the 'etoro-public:real:read' scope. etoro-public:sub-accounts:delete: Grants access to the 'etoro-public:sub-accounts:delete' scope. etoro-public:verification.address:read: >- Grants access to the 'etoro-public:verification.address:read' scope. etoro-public:verification.address:write: >- Grants access to the 'etoro-public:verification.address:write' scope. etoro-public:verification.email:write: >- Grants access to the 'etoro-public:verification.email:write' scope. etoro-public:verification.personaldetails:read: >- Grants access to the 'etoro-public:verification.personaldetails:read' scope. etoro-public:verification.personaldetails:write: >- Grants access to the 'etoro-public:verification.personaldetails:write' scope. etoro-public:verification.phone:write: >- Grants access to the 'etoro-public:verification.phone:write' scope. etoro-public:verification.trusted.email:write: >- Grants access to the 'etoro-public:verification.trusted.email:write' scope. etoro-public:verification.trusted.phone:write: >- Grants access to the 'etoro-public:verification.trusted.phone:write' scope. etoro-public:verification:trusted:user:write: >- Grants access to the 'etoro-public:verification:trusted:user:write' scope. ````