---
title: "Accept an invite"
method: POST
path: "/invites/{token}/accept"
tags: ["Invites"]
---

# Accept an invite

`POST /invites/{token}/accept`

## Request

- Base URL: `https://tasg.app/api/v1`
- URL: `https://tasg.app/api/v1/invites/{token}/accept`
- Auth: none required

No auth. Rate-limited (10/15 min per IP). Existing accounts supply their password; new accounts supply `name` + a strong password and are created as `guest`. Joins the project and returns session tokens. Responds 200 even when an account was created.

## Path parameters

- `token` string, required

## Request body

- object
  - `name` string: Required for new accounts.
  - `password` string, required

## Response `200`

Joined.

- object
  - `user` object, required
    - `id` string, uuid
    - `email` string
    - `full_name` string
    - `avatar_url` string, nullable
    - `role` 'admin' | 'member' | 'guest': Instance-level role. `guest` users are restricted to projects they were invited to.
    - `timezone` string
  - `workspaces` object[], required
    - `id` string, uuid, required
    - `name` string, required
  - `token` string, required: Access JWT.
  - `refreshToken` string, required
  - `project_id` string, uuid, required

## Other responses

- `400`: Validation failed: the body or query did not match the schema, or a business rule was violated. `error` says which.
- `401`: Incorrect password.
- `404`: Not found, or not visible to the caller (tenancy is enforced: foreign resources look identical to missing ones).
- `410`: Already used or expired.
- `429`: Too many attempts.

---

[API](https://skmtc.dev/tasg/apis/tasg-api.md) · [All operations](https://skmtc.dev/tasg/apis/tasg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tasg/apis/tasg-api/revisions/cd2a1dbaf5cf?raw)