> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drssed.app/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /auth/upgrade — Upgrade a guest to full account

> Convert a guest account to a full registered account by providing email, username, and password. Requires guest JWT. Rate limited to 5 per minute.

Call `POST /auth/upgrade` to convert a guest session into a full registered account. You must be authenticated with the guest account's JWT. All data created during the guest session — clothing items, outfits, and other records — is preserved under the same user ID after the upgrade. The same access token and refresh token remain valid after the call.

## Endpoint

| Field         | Value                    |
| ------------- | ------------------------ |
| Method        | `POST`                   |
| Path          | `/auth/upgrade`          |
| Auth required | Yes (guest Bearer token) |
| Rate limit    | 5 per minute             |

## Request body

<ParamField body="email" type="string" required>
  Email address for the new account. Must be unique across all registered accounts.
</ParamField>

<ParamField body="username" type="string" required>
  Username for the new account. Must be unique across all registered accounts.
</ParamField>

<ParamField body="password" type="string" required>
  Password for the new account.
</ParamField>

<ParamField body="profile_picture" type="string">
  Optional profile picture reference to associate with the account.
</ParamField>

## Response fields

**Status: 201 Created**

<ResponseField name="user_id" type="string" required>
  The unique identifier for the user. This is the same ID that was assigned during the guest session.
</ResponseField>

<ResponseField name="username" type="string" required>
  The username set during upgrade.
</ResponseField>

<ResponseField name="email" type="string" required>
  The email address set during upgrade.
</ResponseField>

<ResponseField name="is_guest" type="boolean" required>
  Always `false` after a successful upgrade.
</ResponseField>

<ResponseField name="created_at" type="string" required>
  ISO 8601 timestamp of when the account was originally created (during the guest session).
</ResponseField>

<ResponseField name="updated_at" type="string" required>
  ISO 8601 timestamp of when the account was last updated.
</ResponseField>

<ResponseField name="profile_picture" type="string">
  Profile picture reference, if one was provided in the request.
</ResponseField>

## Example

```bash cURL theme={null}
curl --request POST \
  --url https://api.drssed.com/auth/upgrade \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "alex@example.com",
    "username": "alex",
    "password": "s3cr3tpassword"
  }'
```

```json Response theme={null}
{
  "user_id": "usr_a1b2c3d4e5f6",
  "username": "alex",
  "email": "alex@example.com",
  "is_guest": false,
  "created_at": "2024-11-01T09:15:00Z",
  "updated_at": "2024-11-01T09:22:00Z"
}
```

<Tip>
  Call this endpoint after a user completes onboarding in your app to preserve all the data they created as a guest. There is no need to re-authenticate — your existing tokens continue to work.
</Tip>