--- title: "Send an account invitation" method: POST path: "/accounts/{account}/invitations" tags: ["Account"] --- # Send an account invitation `POST /accounts/{account}/invitations` ## Request - Base URL: `https://api.factuarea.com/v1` - URL: `https://api.factuarea.com/v1/accounts/{account}/invitations` - Auth: one of: - HTTP bearer - API key in header `X-API-Key` Invite a person by email to join the account with a `role` (`admin` or `member`) and a required `grants` list (may be empty). - Only a `member` carries grants; an `admin` invite needs a scope covering every tax ID. Returns 201. - `secret` and `accept_url` appear once, only with `send_email: false`. - Missing `grants` returns 400 `parameter_missing`. Requires the `invitations:write` scope, which `*` does not cover: the API key must list it explicitly. ## Path parameters - `account` string, uuid, required ## Headers - `Idempotency-Key` string, required - `Factuarea-Version` string, date ## Request body - InviteAccountMemberV1Request - `email` string, email, required: Email address the invitation is sent to. - `role` 'admin' | 'member', required: Account role the person would join with: `admin` or `member`. - `grants` object[], required: Initial per-tax-ID grants of the invited person. Required, it can be empty; only a `member` carries grants. - `company_id` string, uuid, required: Public identifier (UUID v7) of a tax ID of your account. - `level` 'view' | 'operate', required: Access level on that tax ID: `view` (read-only) or `operate`. - `send_email` boolean: Send the invitation email (`true`, default) or only return the acceptance link (`false`). ## Response `201` Invitation created. The `Location` header contains the canonical URL of the new account invitation; the body carries its acceptance secret once. - object - `data` AccountInvitationWithSecret, required: The response of creating or resending an account invitation: the fields of `AccountInvitation` PLUS the acceptance `secret` and `accept_url`. They are returned ONLY for a copy-link invitation (`send_email: false`), and only once: when the invitation is delivered by email (`send_email: true`) the secret travels only in that email and both fields are `null`. They are not stored in the clear, not even in the idempotency cache, so an idempotent replay returns both as `null`. Resending issues a NEW secret and the previous one stops working. - `id` string, uuid, required: Opaque identifier of the invitation, a UUID v7. - `object` 'account_invitation', required: Always `account_invitation`. - `email` string, email, required: Address the invitation was sent to. - `role` 'admin' | 'member', required: Account role the person would join with. `owner` never appears: ownership is transferred, never handed out by invitation. - `grants` object[], required: Initial per-tax-ID grants of a `member` invitation, limited to the tax IDs your credential reads. Always empty for an `admin`. - `object` 'account_member_grant', required: Always `account_member_grant`. - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the tax ID of the account the grant applies to. - `level` 'view' | 'operate', required: Access level on that tax ID: `view` is read-only, `operate` can also write. - `send_email` boolean, required: Whether the invitation was delivered by email (`false`: the link was copied and delivered by whoever invited). - `external_advisor` boolean, required: Whether this is the invitation of the external advisor of the account (only created from the web app). - `status` 'pending' | 'accepted' | 'revoked' | 'expired', required: Derived state. `accepted` and `revoked` are final; `expired` only applies to an invitation that was still pending when its expiry passed. - `expires_at` string, date-time, required: Expiry instant (ISO 8601). - `created_at` string, date-time, nullable, required: Instant (ISO 8601) the invitation was created, or `null` when it is not known. - `sent_at` string, date-time, nullable, required: Instant (ISO 8601) of the last send: the creation or the last resend. `null` when it is not known. - `invited_by` object, nullable, required: The person who created the invitation. `null` when that person no longer belongs to the account. - `id` string, uuid, required: Opaque identifier (UUID v7) of the person. - `name` string, required: Full name of the person. - `secret` string, nullable, required: The plaintext acceptance secret, returned ONCE for a copy-link invitation (`send_email: false`). Treat it as a credential: anyone holding it can accept the invitation. `null` when the invitation is delivered by email and in an idempotent replay. - `accept_url` string, uri, nullable, required: Acceptance link carrying the secret, returned ONCE, to deliver yourself when `send_email` is `false`. `null` when the invitation is delivered by email and in an idempotent replay. ## Other responses - `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version. - `401`: Missing or invalid API key. - `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the plan does not include the public API or this feature (`addon_not_active`, `feature_not_available_in_plan`), or the module is not available with a test key (`module_not_available_in_sandbox`). - `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key. - `409`: The request conflicts with data that already exists or with a request running at the same time. `resource_conflict`: another request was reserving identifiers for the same kind of record at that moment and this one could not complete its reservation. Nothing was written; send the request again after a few seconds. - `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters. `idempotency_key_required`: this operation requires the `Idempotency-Key` header; the message names the rejected operation. - `429`: Rate limit exceeded. Retry after the duration in `Retry-After`. - `500`: Unexpected server error. --- [API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)