Invites

Create invite

Emails the invitee an accept link and returns the raw token once so an app can also show a copy-paste link — it is stored only as a hash and cannot be read back. Valid for seven days. An invite is a deferred role assignment, so the same no-escalation rule as PATCH /member/{userId} applies: you may only invite with roles whose permissions you already hold. Requires member:manage. Inviting someone who is already a member answers 409. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers 428 step_up_required). An organization API token is not challenged.

post/invite

Request

  • Base URL: https://api.elaichi.ai
  • URL: https://api.elaichi.ai/invite
  • Auth: HTTP bearer

Headers

X-Organization-Idstring

Target organization (org_…). Required for cookie/session auth on org-scoped routes; optional for API tokens, which carry their organization, and rejected when it names a different one.

Request body

emailstring email required

Lowercased before storage.

role_idsstring[] required

Exactly one role (role_…), granted on acceptance.

team_idsstring[]

Teams (team_…) to join. Defaults to none.

Response

Created

idstring

Invite id (inv_…).

emailstring email

Lowercased at creation.

role_idsstring[]

The single role (role_…) the invitee receives on acceptance.

team_idsstring[]

Teams (team_…) they are added to.

statusstring

Lifecycle state; only pending invites can still be accepted.

expires_atstring date-time

Seven days after creation.

invited_bystring nullable

User id (usr_…) of the inviter.

created_atstring date-time
updated_atstring date-time
tokenstring

Raw invite token — returned once, never retrievable again.

email_sentboolean

False when the invite email could not be delivered (the token still works).

Changes

No recorded changes to this operation across all 1 revision of this API.