---
title: "Preview Invitation"
method: GET
path: "/api/v0/invitations/{token}/preview"
tags: ["organizations"]
---

# Preview Invitation

`GET /api/v0/invitations/{token}/preview`

## Request

- Base URL: `https://api.outerport.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.outerport.com/api/v0/invitations/{token}/preview`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/outerport/apis/outerport-api/docs/api/v0/invitations/:token/preview/get.ts> (a function with typed inputs; its response is checked against the schema)

Look up an invitation by raw token without consuming it.

The caller is always authenticated (the accept-invite page is behind sign-in), so the cap below is
per person. The response omits the inviter's identity, since anyone holding a leaked token (referer
header, log line, browser history) can reach this endpoint.

## Path parameters

- `token` string, required

## Response `200`

Successful Response

- OrganizationInvitationPreviewResponse: Slim invitation view for the unauthenticated preview endpoint. Excludes inviter identity: anyone with a leaked token (referer header, server log, browser history) can hit this endpoint, so we expose only what the invitee strictly needs to decide whether to sign in and accept. The invitee email is *masked* (``email_masked``): the recipient recognizes their own address from the partial shape, but a leaker learns only that it was issued to ``someone at a domain that starts with…`` rather than the full string used downstream as a tenant-membership oracle.
  - `public_id` string, uuid, required: The public id of the invitation.
  - `organization_name` string, required: The name of the inviting organization.
  - `email_masked` string, required: Partially-masked invitee email (e.g. 'a***@e***.com'). The full address is never exposed on this unauth endpoint.
  - `role` string, required: The role the invitee will receive on accept.
  - `status` string, required: pending, accepted, or revoked. Expiry is derived from `expires_at`; an unredeemed invitation past it stays `pending`.
  - `availability` 'pending' | 'accepted' | 'revoked' | 'expired', required: What the invitation is now: `pending` only while it can still be accepted, `expired` once a pending one is past `expires_at`.
  - `expires_at` string, date-time, required: When the invitation expires.

## Other responses

- `422`: Validation Error

## Changes

- **2026-11-09** `ecd5b922e78a`: 1 info
  - added the required property `availability` to the response with the `200` status
- **2026-10-13** `7f81908bcdfe`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/outerport/apis/outerport-api/changes/api/v0/invitations/:token/preview/get.md)

---

[API](https://skmtc.dev/outerport/apis/outerport-api.md) - [All operations](https://skmtc.dev/outerport/apis/outerport-api/llms.txt) - [OpenAPI document](https://skmtc.dev/outerport/apis/outerport-api/revisions/08b5bf6f7f18?raw)