diff --git a/src/ApiResource/Project/ProjectApiResource.php b/src/ApiResource/Project/ProjectApiResource.php
index ae2e319..a260938 100644
--- a/src/ApiResource/Project/ProjectApiResource.php
+++ b/src/ApiResource/Project/ProjectApiResource.php
@@ -69,6 +69,7 @@ class ProjectApiResource
     /**
      * ISO 3166 data about the Project's territory of interest.
      */
+    #[Assert\NotBlank()]
     #[Assert\Valid()]
     public ProjectTerritoryApiResource $territory;
 
@@ -91,5 +92,6 @@ class ProjectApiResource
      *
      * @var array<int, RewardApiResource>
      */
+    #[API\ApiProperty(writable: false)]
     public array $rewards;
 }
diff --git a/src/ApiResource/User/UserApiResource.php b/src/ApiResource/User/UserApiResource.php
index 5d94640..6b47bc0 100644
--- a/src/ApiResource/User/UserApiResource.php
+++ b/src/ApiResource/User/UserApiResource.php
@@ -6,10 +6,13 @@ use ApiPlatform\Doctrine\Orm\Filter\SearchFilter;
 use ApiPlatform\Doctrine\Orm\State\Options;
 use ApiPlatform\Metadata as API;
 use App\ApiResource\Accounting\AccountingApiResource;
+use App\Dto\UserSignupDto;
 use App\Entity\User\User;
 use App\Filter\OrderedLikeFilter;
 use App\Filter\UserQueryFilter;
 use App\State\ApiResourceStateProvider;
+use App\State\User\UserSignupProcessor;
+use App\State\User\UserStateProcessor;
 use Symfony\Component\Validator\Constraints as Assert;
 
 /**
@@ -18,10 +21,11 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[API\ApiResource(
     shortName: 'User',
     stateOptions: new Options(entityClass: User::class),
-    provider: ApiResourceStateProvider::class
+    provider: ApiResourceStateProvider::class,
+    processor: UserStateProcessor::class,
 )]
 #[API\GetCollection()]
-#[API\Post()]
+#[API\Post(input: UserSignupDto::class, processor: UserSignupProcessor::class)]
 #[API\Get()]
 #[API\Patch(security: 'is_granted("USER_EDIT", object)')]
 #[API\Delete(security: 'is_granted("USER_EDIT", object)')]
diff --git a/src/Dto/UserSignupDto.php b/src/Dto/UserSignupDto.php
new file mode 100644
index 0000000..86146d7
--- /dev/null
+++ b/src/Dto/UserSignupDto.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Dto;
+
+use Symfony\Component\Validator\Constraints as Assert;
+
+final class UserSignupDto
+{
+    #[Assert\NotBlank()]
+    #[Assert\Email()]
+    public string $email;
+
+    #[Assert\NotBlank()]
+    #[Assert\Length(min: 8)]
+    public string $password;
+
+    /**
+     * A unique, non white space, byte-safe string identifier for this User.
+     */
+    #[Assert\NotBlank()]
+    #[Assert\Length(min: 4, max: 30)]
+    #[Assert\Regex('/^[a-z0-9_]+$/')]
+    public string $username;
+
+    /**
+     * Display name chosen by the User.
+     */
+    public string $name;
+}
diff --git a/src/Entity/User/User.php b/src/Entity/User/User.php
index a29fba4..630fce8 100644
--- a/src/Entity/User/User.php
+++ b/src/Entity/User/User.php
@@ -29,8 +29,8 @@ use Symfony\Component\Security\Core\User\UserInterface;
 #[MapProvider(EntityMapProvider::class)]
 #[ORM\Entity(repositoryClass: UserRepository::class)]
 #[ORM\Index(fields: ['migratedId'])]
-#[UniqueEntity(fields: ['username'], message: 'This usernames already exists.')]
-#[UniqueEntity(fields: ['email'], message: 'This email address is already registered.')]
+#[UniqueEntity('email', message: 'This email address is already registered.')]
+#[UniqueEntity('username', message: 'This usernames already exists.')]
 class User implements UserInterface, PasswordAuthenticatedUserInterface, AccountingOwnerInterface
 {
     use MigratedEntity;
@@ -43,7 +43,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, Account
     private ?int $id = null;
 
     #[Gedmo\Versioned]
-    #[ORM\Column(length: 255)]
+    #[ORM\Column(length: 255, unique: true)]
     private ?string $email = null;
 
     /**
@@ -56,7 +56,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, Account
      * Human readable, non white space, unique string.
      */
     #[Gedmo\Versioned]
-    #[ORM\Column(length: 255)]
+    #[ORM\Column(length: 255, unique: true)]
     private ?string $username = null;
 
     /**
diff --git a/src/Security/Voter/UserVoter.php b/src/Security/Voter/UserVoter.php
index 54f233c..563d078 100644
--- a/src/Security/Voter/UserVoter.php
+++ b/src/Security/Voter/UserVoter.php
@@ -35,7 +35,7 @@ class UserVoter extends Voter
         return false;
     }
 
-    private function canEdit(UserApiResource $subject, User $user): bool
+    private function canEdit(UserApiResource $subject, ?User $user): bool
     {
         if (!$user instanceof User) {
             return false;
diff --git a/src/State/User/UserSignupProcessor.php b/src/State/User/UserSignupProcessor.php
new file mode 100644
index 0000000..1087959
--- /dev/null
+++ b/src/State/User/UserSignupProcessor.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\State\User;
+
+use ApiPlatform\Metadata as API;
+use ApiPlatform\State\ProcessorInterface;
+use App\ApiResource\User\UserApiResource;
+use App\Dto\UserSignupDto;
+use App\Entity\User\User;
+use App\Mapping\AutoMapper;
+use App\State\EntityStateProcessor;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+
+final class UserSignupProcessor implements ProcessorInterface
+{
+    public function __construct(
+        private AutoMapper $autoMapper,
+        private EntityStateProcessor $entityStateProcessor,
+        private UserPasswordHasherInterface $userPasswordHasher,
+    ) {}
+
+    /**
+     * @param UserSignupDto $data
+     */
+    public function process(mixed $data, API\Operation $operation, array $uriVariables = [], array $context = [])
+    {
+        /** @var User */
+        $user = $this->autoMapper->map($data, User::class);
+        $user->setPassword($this->userPasswordHasher->hashPassword($user, $data->password));
+        $user = $this->entityStateProcessor->process($user, $operation, $uriVariables, $context);
+
+        return $this->autoMapper->map($user, UserApiResource::class);
+    }
+}