---
title: "Accept an invitation. Signed out, with a name and a password: makes the account for the invited address, confirmed, and answers 201 with a session for the organization. Signed in as the invited address, with no body: joins the organization and moves the session there (200). An address that already has an account must sign in to accept; its password is never set here"
method: POST
path: "/v1/invitations/{token}/accept"
---

# Accept an invitation. Signed out, with a name and a password: makes the account for the invited address, confirmed, and answers 201 with a session for the organization. Signed in as the invited address, with no body: joins the organization and moves the session there (200). An address that already has an account must sign in to accept; its password is never set here

`POST /v1/invitations/{token}/accept`

## Request

- Base URL: `https://api.evictionsapi.com`
- URL: `https://api.evictionsapi.com/v1/invitations/{token}/accept`
- Auth: one of:
  - none
  - HTTP bearer

## Path parameters

- `token` string, required

## Request body

- object
  - `name` string, required
  - `password` string, required

## Response `201`

A new session for a new account (`token`, shown here only), with the account view; 200 with the account view alone for a signed-in person. An `Idempotency-Key` header is ignored.

- object
  - `token` string, required: A session token (`ess_...`), shown here only. Send it as `Authorization: Bearer`.
  - `user` object, required
    - `id` string, required
    - `name` string, nullable, required
    - `email` string, required
    - `role` 'customer' | 'attorney' | 'platform_admin', required: The kind of account. The person's role in an organization is the top-level `role`.
    - `emailConfirmed` boolean, required: Whether the person confirmed this address (with the emailed link, or by signing in with Google). Nothing depends on it: an unconfirmed account works the same.
    - `hasPassword` boolean, required: Whether the account has a password (an account made with Google has none until one is set).
    - `googleLinked` boolean, required: Whether a Google account is linked, so the person can sign in with Google.
  - `organization` object, nullable, required: The organization this session acts for; null when the person belongs to none.
    - `id` string, required
    - `name` string, required
    - `verified` boolean, required
    - `kind` unknown, required
    - `contactEmail` string, nullable, required
    - `contactPhone` string, nullable, required
    - `contactAddress` string, nullable, required
    - `billingEmail` string, nullable, required
  - `role` unknown, required
  - `permissions` string[], required: What the person may change in that organization. Reading needs no permission. Empty without an organization.
  - `organizations` object[], required: Every organization the person belongs to, oldest membership first.
    - `id` string, required
    - `name` string, required
    - `kind` unknown, required
    - `role` 'owner' | 'member' | 'viewer' | 'custom', required
    - `caseEmails` 'all' | 'mine' | 'none', required: Which of the organization's case emails the person gets: all, only cases they opened, or none (`PATCH /v1/me/organizations/:id`).
  - `modes` object, required: The modes this server offers. `test` is always true.
    - `test` boolean, required
    - `live` boolean, required

## Other responses

- `400`: `invalid_request`: signed out, the body needs `name` and a `password` of 10 to 200 characters (`details.issues` names them).
- `401`: `unauthenticated`: an `Authorization` header was sent and is not a valid session.
- `403`: `account_kind`: an attorney's or the operator's account cannot join an organization. `forbidden`: an API key, or a disabled account.
- `404`: `invitation_invalid`: the token is unknown, already used, revoked or expired.
- `409`: `invitation_email_mismatch`: the session is for another address. `email_taken`: signed out, and the invited address already has an account; sign in to accept. `already_member`: the person is a member already. `member_limit`: the organization already has 50 people. Nothing was created and the invitation is still pending.
- `413`: The request body is too large.
- `429`: Too many requests from this address: at most 30 every 10 minutes, counting both invitation endpoints. `Retry-After` gives the seconds to wait.
- `503`: `busy`: too many password checks are waiting. Nothing was created. `Retry-After: 5` gives the seconds to wait.

---

[API](https://skmtc.dev/evictionsapi/apis/evictions-api.md) · [All operations](https://skmtc.dev/evictionsapi/apis/evictions-api/llms.txt) · [OpenAPI document](https://skmtc.dev/evictionsapi/apis/evictions-api/revisions/28459213a1a3?raw)