services/nginx/app/routes/subusersRoute.php

@@ -2191,8 +2191,9 @@ class subusersRoute
             'edit_subusers' => 'List chauffeur permission templates while editing chauffeur grants.',
         ]);
 
+        // Public registration endpoint — must stay publicly accessible (no
+        // scope check); new drivers cannot hold a scope before they exist.
         $this->post('/subusers', function () {
-            ScopeMiddleware::requireScope(Scope::SUBUSER_WRITE, '/subusers');
             $this->registerPublicSubuser();
         });
         $this->get('/subusers/setup', function () {
@@ -3087,8 +3088,9 @@ class subusersRoute
             'edit_own_subusers' => 'Customers cannot edit chauffeur account profiles. They may only manage grants, permissions, and enabled state.',
         ]);
         // Public registration endpoint (alias of POST /subusers) matching OpenAPI: POST /subusers/me
+        // Must stay publicly accessible — no scope check here; new drivers do
+        // not hold a scope before they exist.
         $this->post('/subusers/me', function () {
-            ScopeMiddleware::requireScope(Scope::SUBUSER_WRITE, '/subusers/me');
             $this->registerPublicSubuser();
         });
     }