---
title: "Accept a team invite (verify code)"
method: POST
path: "/invites/{token}/accept"
tags: ["Public", "Invites"]
---

# Accept a team invite (verify code)

`POST /invites/{token}/accept`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/invites/{token}/accept`
- Auth: none declared

SMS-channel invites only: checks the one-time code against the invited
mobile. On success the account is **created if new** (unusable random
password, default grower — exactly like phone sign-in), the mobile is
marked verified, this role is attached and accepted, any other pending
invites for the number are claimed, and the standard first-party
Doorkeeper token payload is returned (same shape as
`POST /users/phone-sessions/verify`).

## Path parameters

- `token` string, required

## Request body

- object
  - `code` string, required: The 6-digit code from the SMS.

## Response `200`

Invite accepted — Doorkeeper access token; includes `user_id`.

- DoorkeeperAccessTokenResponse: Access token issued by Doorkeeper. The same fields are returned from `POST /oauth/token` (RFC 6749). First-party endpoints (`POST /users/sign-in`, `POST /users/access-tokens`) add `user_id` for convenience.
  - `access_token` string, required: Opaque bearer token. Send as header Authorization: Bearer {token} on /api/v1/* routes.
  - `token_type` string, required
  - `expires_in` integer: Lifetime of the access token in seconds.
  - `refresh_token` string, nullable: Present when the client and grant type allow refresh tokens.
  - `scope` string: Granted scopes (space-separated).
  - `user_id` string, uuid, nullable: Only returned by first-party JSON endpoints (`/users/sign-in`, `/users/access-tokens`), not by `POST /oauth/token`.
  - `actor_id` string, uuid, nullable: The acting entity's id (first-party endpoints only). Equals `user_id` today; becomes the Organization id when a token is scoped to act for an organization.
  - `actor_type` 'User' | 'Organization', nullable: Polymorphic type of `actor_id` (first-party endpoints only).

## Other responses

- `403`: Forbidden — first-party only; refused to an API key or an assistant's token.
- `404`: Unknown, revoked or already-claimed invite.
- `422`: Incorrect/expired code, expired invite, or not an SMS-channel invite.

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/29c5c990d66e?raw)