Sign in
Members

Accept a team invitation

Changed on

Consumes the single-use invite token (CAS — a replay or a race loses) and attaches the membership. If no account exists for the invited email, password is required (min 12 chars), the account is created, and a session cookie is minted (session_minted: true). An EXISTING account is attached WITHOUT a session — possession of the email alone must not log into an already-privileged account; the user signs in with their own password afterwards. ADR-081.

post/v1/auth/accept-invite

Request

  • Base URL: http://localhost:8080
  • URL: http://localhost:8080/v1/auth/accept-invite
  • Auth: HTTP bearer

Request body

tokenstring required
passwordstring

Required (and validated) only when no account exists for the invited email; ignored otherwise.

Response

Membership attached; cookie set when session_minted is true

user_idstring required
emailstring required
tenant_idstring required
session_mintedboolean required
livemodeboolean required
expires_atstring required

Session expiry (RFC 3339) when session_minted; empty string otherwise.

Changes