---
title: "Invite a member by email (owner-only + step-up)"
method: POST
path: "/orgs/v1/{org_id}/invites"
tags: ["Org"]
---

# Invite a member by email (owner-only + step-up)

`POST /orgs/v1/{org_id}/invites`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/orgs/v1/{org_id}/invites`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

If the email already maps to a principal they are added active; otherwise a pending invited membership is created and claimed at first login. Creating (or re-POSTing) a pending invite sends a notification email to the invitee — re-invite is resend, rate-limited to one send per (org, email) per 5 minutes. The email is a notification, not a token: signing in with the invited email is the acceptance.

## Path parameters

- `org_id` string, uuid, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `email` string, email, required
  - `role` 'owner' | 'admin' | 'developer' | 'billing' | 'viewer'
  - `invite_ttl_hours` integer

## Response `201`

Invited or added

- object
  - `status` 'invited' | 'added'
  - `principal_id` string, uuid
  - `role` 'owner' | 'admin' | 'developer' | 'billing' | 'viewer'
  - `email_sent` boolean: Present only for status=invited. Whether a notification email was sent on this request — false when the resend was rate-limited (one send per org+email per 5 minutes) or delivery failed; the pending invite is live either way and is accepted by signing in with the invited email.

## Other responses

- `403`: Owner role required (FORBIDDEN)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)