---
title: "Invite customers"
method: POST
path: "/customers/invitations"
tags: ["Customers"]
---

# Invite customers

`POST /customers/invitations`

Invite specific customers by email or phone to approve a set of your agents, each with its own permissions and limits

## Headers

- `X-Instance-ID` string, nullable

## Request body

- object
  - `data` object, required
    - `attributes` object, required
      - `recipients` union[], required — Each recipient is one of three shapes: an email recipient (which may carry onboarding details), a phone recipient, or an existing customer referenced by party ID.
        - union
          - object
            - `type` 'email', required
            - `value` string, email, required — Email address.
          - object
            - `type` 'phone', required
            - `value` string, required — Phone number.
          - object
            - `type` 'party_id', required
            - `value` string, required — Natural party ID (pty_*).
      - `agents` object[], required — Agents to grant access to. Each recipient receives an invitation for every agent listed.
        - `agentId` string, required — Agent ID (agt_*).
        - `permissions` string[], required — Permissions to grant this agent.
        - `limits` object — Transaction limits for this agent.
          - `perTransaction` integer, nullable — Per-transaction spending limit in cents, or null for no limit.
      - `expiresAt` string, date-time — RFC 3339 timestamp when the invitation expires. Defaults to 30 days from now; maximum 90 days.
      - `message` string — Message stored with each recipient's invitation. It is not included in the invitation email.
      - `tags` object — Tags applied to each invitation.

## Response `201`

Successful Response

- object
  - `data` object[], required — Created invitations.
    - `type` 'agentDelegationInvitation', required — Resource type. Always `agentDelegationInvitation`.
    - `id` string, required — Invitation ID (adi_*).
    - `attributes` object, required — Invitation details.
      - `developerName` string, required — Developer name.
      - `email` string, required — Recipient email.
      - `phone` string, nullable, required — Recipient phone.
      - `url` string, uri, required — Invitation URL. Natural sends it automatically for email invitations; deliver it yourself for phone invitations.
      - `agentName` string, required — Agent name.
      - `permissions` string[], required — Permissions granted on accept.
      - `limits` object, nullable, required — Transaction limits.
        - `perTransaction` integer, nullable — Per-transaction spending limit in cents, or null for no limit.
      - `status` 'PENDING' | 'ACCEPTED' | 'DECLINED' | 'EXPIRED' | 'CANCELED', required — Invitation status.
      - `effectiveStatus` 'PENDING' | 'ACCEPTED' | 'DECLINED' | 'EXPIRED' | 'CANCELED', required — Status after applying expiry: reads EXPIRED once `expiresAt` has passed even while `status` is still PENDING.
      - `expiresAt` string, required — RFC 3339 timestamp when the invitation expires.
      - `acceptedAt` string, nullable, required — RFC 3339 timestamp when the invitation was accepted, or null.
      - `declinedAt` string, nullable, required — RFC 3339 timestamp when the invitation was declined, or null.
      - `cancelReason` 'AGENT_RETIRED' | 'DEVELOPER_RETIRED' | 'DEVELOPER_REVOKED' | 'CONNECTION_ESTABLISHED', nullable, required — Reason for cancellation.
      - `tags` object, required — Metadata visible to anyone who can read the resource.
      - `createdAt` string, required — RFC 3339 timestamp when the invitation was created.
      - `updatedAt` string, required — RFC 3339 timestamp when the invitation was last updated.
    - `relationships` object, required — Related resources.
      - `agent` object, required — The invited agent.
        - `data` object, required — Related resource identifier.
          - `type` 'agent', required — Resource type. Always `agent`.
          - `id` string, required
      - `customerParty` object, required — Customer party that accepted the invitation, or null until acceptance.
        - `data` object, nullable, required — Related resource identifier.
          - `type` 'party', required — Resource type. Always `party`.
          - `id` string, required
  - `meta` object, required — Metadata about the batch.
    - `failedRecipients` object[], required — Recipients whose invitations could not be created.
      - `recipient` union, required — Recipient that failed.
        - object
          - `type` 'email', required
          - `value` string, email, required — Email address.
        - object
          - `type` 'phone', required
          - `value` string, required — Phone number.
        - object
          - `type` 'party_id', required
          - `value` string, required — Natural party ID (pty_*).
      - `reason` string, required — Why this recipient's invitations failed.
    - `alreadyConnected` object[], required — Agent-recipient pairs skipped because the agent is already connected to the recipient's party. Requested permissions and limits were not applied.
      - `recipient` union, required — Recipient whose party already has an active connection to the agent.
        - object
          - `type` 'email', required
          - `value` string, email, required — Email address.
        - object
          - `type` 'phone', required
          - `value` string, required — Phone number.
        - object
          - `type` 'party_id', required
          - `value` string, required — Natural party ID (pty_*).
      - `agentId` string, required — Agent that is already connected.
      - `agentDelegationId` string, required — Existing active agent delegation that satisfied the request.

## Other responses

- `400` — Validation Error
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found. Returned when the resource does not exist, or when it exists but is not accessible to your account. The two cases are intentionally indistinguishable, so that resource IDs cannot be enumerated by probing.
- `409` — Conflict
- `422` — Validation Error. The response contains one error object for each invalid request value.
- `428` — Precondition Required
- `429` — Too Many Requests
- `500` — Internal Server Error
- `501` — Not Implemented
- `502` — Bad Gateway
- `503` — Service Unavailable

## Changes

- **2026-09-15** `1132c9ddb7bd` — 6 info
  - added the new `card_payments.read` enum value to the request property `data/attributes/agents/items/permissions/items/`
  - added the new `chargebacks.read` enum value to the request property `data/attributes/agents/items/permissions/items/`
  - added the new `enrollment.read` enum value to the request property `data/attributes/agents/items/permissions/items/`
  - added the new `mandates.read` enum value to the request property `data/attributes/agents/items/permissions/items/`
  - …2 more
- **2026-09-05** `1197c1fb1ef2` — 1 info
  - added the new `payment_intents.create` enum value to the request property `data/attributes/agents/items/permissions/items/`
- **2026-09-02** `c7c12da5915f` — 12 info
  - added the optional property `errors/items/meta/limitScope` to the response with the `400` status
  - added the optional property `errors/items/meta/limitScope` to the response with the `401` status
  - added the optional property `errors/items/meta/limitScope` to the response with the `403` status
  - added the optional property `errors/items/meta/limitScope` to the response with the `404` status
  - …8 more
- **2026-08-27** `359d267dca88` — 1 info
  - deleted the `header` request parameter `X-Agent-ID` with deprecation
- …earlier changes not shown

[Full history](https://skmtc.dev/natural/apis/natural-api/changes/customers/invitations/post.md)

---

[API](https://skmtc.dev/natural/apis/natural-api.md) · [All operations](https://skmtc.dev/natural/apis/natural-api/llms.txt) · [OpenAPI document](https://skmtc.dev/natural/apis/natural-api/revisions/1132c9ddb7bd?raw)