> For the complete documentation index, see [llms.txt](https://doc.api.tieto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.api.tieto.com/open-banking-platform/sandbox-guide/registration-and-onboarding.md).

# Registration and Onboarding

Registration is self-service. The public part of the portal — catalog, documentation and guides — needs no account at all; registering is what unlocks the sandbox, application management, certificate management and your own user administration.

## What you do

1. Submit the registration form: the organization's name, and your own name, email address and phone number.
2. Collect the welcome email and sign in.
3. Link an authenticator app. Two-factor authentication is mandatory — any time-based one-time password app will do.
4. Complete your profile.

That is the entire gate. From this point you have access to the sandbox APIs: no certificates, no subscription, no agreement.

## What you learn

The first person to register for an organization becomes its **Superuser**. Nobody else can self-register into that organization — they are invited. So a TPP's account is bounded from the first minute: one accountable owner, who then builds their own team inside it.

**You decide how open the door is.** Onboarding is configurable per deployment, and per tenant in multi-tenant ones.

| Model          | Behavior                                                                                                                                                                                                                                                             |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Automatic      | The TPP is created Active and receives its welcome email immediately. This is what the public sandbox uses — which is why you were able to register unattended.                                                                                                      |
| Approval-based | The TPP is created with status New. Administrators holding the agreements role are alerted and either approve or reject. On approval the TPP becomes Active and is invited to activate its profile; on rejection the record is closed and the applicant is notified. |

**TPPs manage their own teams.** Six predefined roles, and a user can hold several: 

| Role                        | Grants                                                                                                                                      |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Superuser                   | Everything, including inviting users, assigning roles, suspending users and resetting passwords. The only role that can manage other users. |
| Client applications manager | Create and manage client applications and view subscriptions.                                                                               |
| Client applications viewer  | Read-only view of client applications and subscriptions.                                                                                    |
| Certificates manager        | Upload, generate, rename, revoke and download certificates.                                                                                 |
| Certificates viewer         | Read-only view of certificates.                                                                                                             |
| Access to reports           | Generate and download reports.                                                                                                              |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.api.tieto.com/open-banking-platform/sandbox-guide/registration-and-onboarding.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.