---
title: "Create Invitation"
method: POST
path: "/api/v1/organizations/current/invitations"
tags: ["authed"]
---

# Create Invitation

`POST /api/v1/organizations/current/invitations`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/organizations/current/invitations`
- Auth: none declared

Mint an invitation and email its accept link. The response is the
only time the full link is ever shown — the row keeps the token's
hash. The email is best-effort: the row is durable and the link was
revealed, so a failed send costs a log line, never the 201.

## Request body

- CreateInvitationRequest
  - `email` string, required
  - `role` 'owner' | 'member', required

## Response `201`

Successful Response

- CreatedInvitationResponse
  - `id` string, uuid, required
  - `email` string, required
  - `role` 'owner' | 'member', required
  - `status` 'pending' | 'accepted' | 'revoked' | 'expired', required: The invitation lifecycle (the CHECK's mirror). pending is the only live state; accepted, revoked, and expired are terminal. expired may also be stamped lazily after expires_at passes — readers judge a pending row by its deadline, not this label alone.
  - `expires_at` string, date-time, required
  - `created_at` string, date-time, required
  - `invite_link` string, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: That address already belongs to an active member, or a live invitation for it is already out
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)