# Airlock IAM user-self-registration data route
# Date: 2026-11-10

Route: `POST /auth/rest/public/user-self-registration/registration/data`

This server-only handler is absent from the retained client URL-builder inventory but is installed identically on eight Airlock IAM tenants.

## Method contract

With a fresh anonymous `AL_SESS-S`/`CSRFT759-S` session, matching `X-CSRFT759`, and `X-Same-Domain: 1`:

- GET returns the standard 132-byte JSON:API HTTP 405 response.
- OPTIONS returns HTTP 200 with `Allow: POST,OPTIONS` and an empty body.
- A controlled same-prefix path with a different intermediate segment returns JSON:API 404 for both GET and OPTIONS, distinguishing this exact handler from a generic registration-prefix catch-all.

A prior XML POST was rejected by the gateway's generic HTTP 400 page before application dispatch. The registration-data operation itself was not invoked.

## Eight-tenant evidence

host | GET 405 | OPTIONS 200 / Allow POST,OPTIONS
--- | --- | ---
infoportal.baloise.de | `01a1c470-ddf7-745f-8976-a7b086b7cf9d` | `01a1c470-de83-7420-98c7-3b77861f9afa`
maklerportal.baloise.de | `01a1c470-e8bf-70ca-a0d5-d30a132877c2` | `01a1c470-e94d-772c-a79f-5063b5178bec`
si-portal.baloise.de | `01a1c470-f446-769c-9dc2-997786097fc9` | `01a1c470-f4d5-71cf-a2d6-d2d0a54c9397`
vertriebsservice.baloise.de | `01a1c471-0155-7780-a0c0-ff74a41bc1ce` | `01a1c471-01e0-7448-81d8-933d48d80fe2`
zeus-portal.baloise.de | `01a1c471-0e14-7626-9118-5bd2eb60051c` | `01a1c471-0ea5-7743-b9dc-18d63a897f46`
mein-portal.baloise.de | `01a1c471-1acf-72d6-ad97-f155fcf01b86` | `01a1c471-1b55-7580-8be3-3c738af3319b`
mein-portal-registrierung.baloise.de | `01a1c471-268f-7042-a7ea-7b2778531012` | `01a1c471-2721-715f-9f7e-be068a8d05ad`
va.baloise.de | `01a1c471-3161-72d0-8465-5735d716f4fc` | `01a1c471-31ee-75f3-ac4e-a812a6f41fea`