Simplified Account Flow with Claiming a Business.

## Overview
The account creation and claim process is designed as a streamlined migration path for existing Corporate Online users to the new Business Registry system. Users receive an email with a direct link to the new login page, where they authenticate using a BC Services Card. If an account already exists, they are directed to their dashboard; otherwise, a minimal account is created automatically. To claim an existing business, users enter the business registration number and company password, which the system validates before linking the business to their account. The process supports claiming multiple businesses and defaults payment to credit card for migrated users.

## Simplified Process flow Diagram
https://www.figma.com/design/AsU4GwwS2ETF6oUVkftP2m/Account-Creation-and-Claim?node-id=0-1&t=GU7NkrXDTjAgsYQ0-1

Feedback designs:
https://www.figma.com/design/9geDdDQoe3Hdx8o1ygJ0sw/Simplified-Account-Creation?node-id=9286-2490&p=f&m=dev

---

## Business Rules:
### General
**Authentication Rule:** All users must authenticate using BC Services Card before accessing Business Registry.
**Account Creation Rule:** If no account exists, system creates one with minimal required data (email address).
**Business Claim Rule:** Linking a business requires valid registration number and company password.
**One-Time Claim Rule:** Claim process is only required for migrated businesses; new businesses are auto-linked.
**Payment Rule:** Default payment method for migrated users is credit card.
**Error Handling Rules:**
- Invalid login → Retry.
- Missing fields → Prompt user.
- Incorrect credentials → Retry.
- Forgotten password → Redirect to Colin.
- System failure → Display error and provide support contact.
**Timeout Rule:** Session inactivity triggers restart of process.
**Security Rule:** No sensitive data (e.g., passwords) is stored in plain text in the new system.
**Scalability Rule:** Process must support multiple business claims per user.
**Compliance Rule:** Identity verification must meet government standards for strong authentication.

### Affiliation by passcode: using an API call to connect a business to an account
**Eligibility:** Affiliation by passcode is only available for businesses migrated from the legacy system.
Each migrated business must have a valid passcode generated in the legacy system.
**Account Requirements:** The user must have a valid account ID in the SBC Connect system. The account must have an active API key for authentication.
**Validation Before Affiliation:** The system must check if the business is already affiliated with the account. If the business is already affiliated, the system must return an error and prevent duplicate affiliation.
**Affiliation Creation:** To create an affiliation, the system must receive:
- accountId (the account requesting affiliation)
- businessIdentifier (unique identifier of the business)
- certifiedName (name of the person certifying the request)
- passcode (valid passcode for the business)
The system must validate the passcode against the business record before creating the affiliation.
**Response After Affiliation:** On successful affiliation, the system must return:
- Business identifier
- Affiliation details (timestamp, account info)
- Status indicating affiliation is active.
**Error Handling:** If the passcode is invalid, the system must return an error message indicating invalid passcode. If the account or business identifier is missing or incorrect, the system must return an error message indicating invalid request.
Security: All API calls must be authenticated using the account’s API key. Passcodes must not be stored in plain text after validation.

Start by reviewing the linked Figma flow and feedback designs, then trace how the existing Business Registry account and affiliation API work. Define the implementation scope around authentication, minimal account creation, migrated-business claiming, duplicate prevention, and error handling. Done means the documented business rules are supported, including multiple claims and secure passcode handling.

Written by the indexing model from the issue text.