Invite a colleague (preview, then confirm)

Owner or admin. Always creates a pending invite and emails it, even when the address already has a posterly account (it joins at their next sign-in if they do not click the link). The email subject names the inviter (their name with their email address, or just their email address) and the workspace. Admin seats are dashboard-only over the API. The invite counts toward the plan seat limit while pending. The workspace owner is emailed about every API team change, naming the API key. Two steps. Without confirm: true the call returns 200 with requires_confirmation, a plain-language preview and a short-lived preview_id, and changes nothing. Show the preview to the user; after they approve, repeat the call with confirm: true and the preview_id. If anything changed in between, the confirm answers 409 preview_stale and changes nothing (a safeguard for the user, not a security control: every rule is checked again on confirm). Access: an API key that a person granted "Manage team" in /dashboard/api (members:read and members:write). Browser sessions are refused with api_key_required; the scopes can never be requested through POST /api/v1/api-keys. ChatGPT, Claude and other OAuth connections hold both scopes implicitly (when their grant includes accounts:write) but may call this endpoint only while the person is an owner or admin of the workspace; otherwise 403 team_management_requires_admin. A key bound to another workspace, or a caller who is not a member, gets 404; a caller whose seat was removed gets 403 workspace_access_revoked. Repeats: the same email, role and brands answers 200 already_invited and sends nothing unless resend: true. A current member answers 409 already_member (use PATCH). Send an Idempotency-Key header on the confirm call to make retries safe. Limits (previews count): 10 invite requests per workspace and 30 per user per 24 hours, and 3 emails per address per workspace per 24 hours. Confirmed invites are processed one at a time per workspace so two parallel calls cannot both take the last seat. Error codes: api_key_required, insufficient_scope, insufficient_role, team_management_requires_admin (403, OAuth connection below admin), admin_role_dashboard_only, plan_required, subscription_required (402), seat_limit_reached (403, with seats_used and seat_limit), validation_error, cannot_invite_self, invalid_brand_ids, preview_required, preview_stale (409), already_member (409), invite_in_progress (409), idempotency_key_reused (409), rate_limited / recipient_rate_limited (429), temporarily_unavailable (503).