---
title: "Revoke Invitation"
method: POST
path: "/api/v1/organizations/current/invitations/{invitation_id}/revoke"
tags: ["authed"]
---

# Revoke Invitation

`POST /api/v1/organizations/current/invitations/{invitation_id}/revoke`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/organizations/current/invitations/{invitation_id}/revoke`
- Auth: none declared

Kill the link. Idempotent on revoked/expired rows; an accepted
invitation refuses — the membership it minted is the thing to remove.
404 for unknown AND foreign ids alike: another org's row is invisible
under the tenant policy, so existence stays unprobeable.

## Path parameters

- `invitation_id` string, uuid, required

## Response `200`

Successful Response

- InvitationResponse
  - `id` string, uuid, required
  - `email` string, required
  - `role` 'owner' | 'member', required
  - `status` 'pending' | 'accepted' | 'revoked' | 'expired', required: The invitation lifecycle (the CHECK's mirror). pending is the only live state; accepted, revoked, and expired are terminal. expired may also be stamped lazily after expires_at passes — readers judge a pending row by its deadline, not this label alone.
  - `expires_at` string, date-time, required
  - `created_at` string, date-time, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: Already accepted
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)