Apps

Invite someone (from an app, as admin)

For an app's own server code only, on behalf of the signed-in user: fetch(env.HYPAMOON_API + "/app-users", ...) without an Authorization header, forwarding the x-hypamoon-user and x-hypamoon-user-sig headers of the request unchanged. Only forward them: never check the signature in the app code yourself, Hypamoon does. Without them 401; a signed-in user without the app's first role in auth.roles (admin by default) 403. Lets this person sign in with the given role and emails them a sign-in link that works once and stays valid for 7 days. The email comes in the app's own style and language and names the admin who invited them. Limits per app: 20 invitations per hour and 100 per day, and the same address once per 10 minutes (429 with Retry-After). Someone who is already a user gives 409.

post/app-users

Request

  • Base URL: https://api.hypamoon.com/api/v1
  • URL: https://api.hypamoon.com/api/v1/app-users
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL https://app.hypamoon.com/oauth/authorize, token URL https://api.hypamoon.com/oauth/token, scopes: data:write)

Request body

emailstring email required

Their email address. Ask the admin for it; never guess one.

namestring

Their name, shown in the app and in the list.

rolestring

One of the app's roles. Defaults to default_role.

Response

Invited, and the email is on its way.

idstring uuid required

The person's id: sub in x-hypamoon-user.

emailstring required
namestring nullable required
rolestring required
created_atstring required
last_sign_in_atstring nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.