---
title: "POST /organizations/{organization_id}/invitations"
method: POST
path: "/organizations/{organization_id}/invitations"
tags: ["Organization Invitations"]
---

# POST /organizations/{organization_id}/invitations

`POST /organizations/{organization_id}/invitations`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/organizations/{organization_id}/invitations`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Create an invitation to join an organization

## Path parameters

- `organization_id` string, required: Organization ID or label identifier

## Headers

- `X-Client-Request-ID` string, uuid

## Request body

- OrgManagementCreateInvitationRequest
  - `email` string, email, required: Email address to invite
  - `role` 'org_admin' | 'org_member' | 'org_viewer', required: User's role in the organization

## Response `201`

Invitation created successfully

- OrgManagementInvitation
  - `id` string, required: Identifier for API resources. A 26-char nanoid (URL/DNS safe).
  - `email` string, email, required: Email address for the invitation
  - `organization_id` string, required: Identifier for API resources. A 26-char nanoid (URL/DNS safe).
  - `created_at` string, date-time, required: The time the entity was created in utc
  - `updated_at` string, date-time, required: The time the entity was mostly recently updated in utc
  - `created_by` string, required: Identifier for API resources. A 26-char nanoid (URL/DNS safe).
  - `role` 'org_admin' | 'org_member' | 'org_viewer', required: User's role in the organization
  - `status` 'pending' | 'accepted' | 'expired' | 'revoked', required: Status of an invitation
  - `expires_at` string, date-time, required: When the invitation expires
  - `permissions` OrgManagementPermissions: Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `404`: not found error response when caller does not have permission to see a resource or the resource does not exist
- `409`: Pending invitation already exists for this email
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 18 breaking, 9 warning, 92 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `404`
  - …115 more
- **2026-03-16** `d3d69f45bfed`: 3 info
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `org-management_bearerAuth` was removed from the API
- **2026-02-24** `0aa1f5c87e81`: 1 breaking, 1 info
  - the request property `role` became required
  - the `role` request property default value `org_admin` was removed
- **2026-02-06** `edd1b760a989`: 1 warning, 2 info
  - deleted the `header` request parameter `X-Request-ID`
  - the endpoint scheme security `org-management_bearerAuth` was added to the API
  - the endpoint scheme security `svc-org-management_bearerAuth` was removed from the API

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/organizations/:organization_id/invitations/post.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)