---
title: "Accept an invitation link to be let in"
method: POST
path: "/api/me/invite"
---

# Accept an invitation link to be let in

`POST /api/me/invite`

## Request

- Base URL: `https://www.toma.com`
- URL: `https://www.toma.com/api/me/invite`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`

The signed-in account accepts a member's invitation link using its token and is let in; signing up continues on /welcome. A member already let in gets their profile back unchanged. Web and REST only, like the other sign-up steps. A few tries per account per hour.

## Request body

- object
  - `token` string, required: The token from the invitation link a member shared.

## Response `200`

Let in; signUp names the next step.

- Me
  - `id` string, required: The account id. Public page: /members/{id}.
  - `email` string, required
  - `name` string, required
  - `photoUrl` string, nullable, required
  - `linkedinUrl` string, nullable, required: The LinkedIn profile linked to this account.
  - `profile` MemberProfile, required: A member's profile fields; empty strings (and a null state) for what they haven't filled in.
    - `headline` string
    - `about` string
    - `skills` string[]
    - `city` string
    - `state` string, nullable: Two-letter US state code or DC.
    - `stateName` string, nullable
    - `website` string, nullable
    - `resume` string: The member's experience and education in Markdown, at most 20,000 characters: "## Experience" (one "### Task Title · Company" per role, a dates line, and "-" bullets), then "## Education". Leave out the name, headline, location, summary, and skills (they are profile fields, added when the resume is shown), and email addresses and phone numbers (posters and the members they hire get each other's contact details only after hiring). Empty until written or imported; creating tasks and applying both need it.
    - `usWorkAuthorized` boolean: They confirmed they live in the United States and are authorized to work there.
    - `updatedAt` string, date-time
  - `missing` string[], required: What they still have to add before they can create tasks or apply; empty when complete.
  - `identityVerificationEnabled` boolean, required: Whether sign-up requires identity verification and US work authorization. Disabled by default.
  - `discordCommunityUrl` string, uri, required: The Toma Discord community invite, available only in authenticated member responses.
  - `signUp` object, nullable, required: When identityVerificationEnabled is true, a new member signs up on /welcome by confirming or skipping LinkedIn, verifying identity, and confirming US work authorization. Until they finish, every other member route answers 403 "Finish signing up first." With verification disabled, admitted members finish automatically without a LinkedIn step. Null once finished. Invite-only admission still applies.
    - `step` 'linkedin' | 'identity' | 'work', required: The sign-up step to do next.
    - `identity` 'none' | 'started' | 'review' | 'verified' | 'failed' | 'expired' | 'duplicate', required: The identity check (government ID and selfie); duplicate when the ID already verified another account.
    - `verifiedName` string, nullable, required: The name on the verified ID.

## Other responses

- `400`: The invitation link is invalid or unavailable.
- `401`: No valid session or API key.
- `403`: Email ownership must be verified before accepting.
- `409`: This invite link has no places left. Reserved email recipients can still join.
- `413`: The request body exceeds 2097152 bytes.
- `429`: Too many tries this hour.

---

[API](https://skmtc.dev/toma/apis/toma-api.md) - [All operations](https://skmtc.dev/toma/apis/toma-api/llms.txt) - [OpenAPI document](https://skmtc.dev/toma/apis/toma-api/revisions/b4e56e1db5a2?raw)