Account

Send an account invitation

Invite a person by email to join the account with a role (admin or member) and a required grants list (may be empty).

  • Only a member carries grants; an admin invite needs a scope covering every tax ID. Returns 201.
  • secret and accept_url appear once, only with send_email: false.
  • Missing grants returns 400 parameter_missing. Requires the invitations:write scope, which * does not cover: the API key must list it explicitly.
post/accounts/{account}/invitations

Request

  • Base URL: https://api.factuarea.com/v1
  • URL: https://api.factuarea.com/v1/accounts/{account}/invitations
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

accountstring uuid required

Public identifier (UUID v7) of your account. Get it from GET /v1/me (data.account.id).

Headers

Idempotency-Keystring required
Example:01928f10-7c0e-7c4a-9b7d-2f8a6e3c1d4b

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 422 idempotency_key_reused; the values of secret fields (password, secret…) count as part of the body, so retrying with a corrected secret under the same key is a different request, never the replay of the earlier answer. See the Idempotency guide. Required on this operation: repeating it delivers an effect that cannot be taken back (an email sent, a file generated, a third-party call, a charge), so a request without this header is rejected with 422 idempotency_key_required before any business logic runs.

Factuarea-Versionstring date
Example:2026-06-01

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Request body

emailstring email required

Email address the invitation is sent to.

role'admin' | 'member' required

Account role the person would join with: admin or member.

send_emailboolean

Send the invitation email (true, default) or only return the acceptance link (false).

Response

Invitation created. The Location header contains the canonical URL of the new account invitation; the body carries its acceptance secret once.

Example response

{
  "data": {
    "id": "01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8c20",
    "email": "marta@acme.example",
    "grants": [
      {
        "company_id": "01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01"
      }
    ],
    "send_email": true,
    "expires_at": "2026-10-03T09:15:00Z",
    "created_at": "2026-09-26T09:15:00Z",
    "sent_at": "2026-09-26T09:15:00Z",
    "invited_by": {
      "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b11",
      "name": "Marta Ibáñez"
    },
    "secret": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "accept_url": "https://app.factuarea.com/invitation/accept?token=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.