Auth

Step 1 of invite acceptance — set password

Step 1 of the two-step invite acceptance flow (Phase 1+2 of MFA roadmap).

Validates the 7-day invite token, sets the user's password, and decides which branch to return:

  • Park admin / super admin (admin or any sa_* role): returns kind="mfa_enrolment_required" with a 15-minute invite_enrolment_token. The frontend takes that token to the MFA enrolment endpoints; users.is_verified flips when the first method activates.
  • Other invitees: returns kind="session" with a full access token, exactly like the legacy single-shot endpoint.

The 7-day invite link itself remains valid until the user's full setup completes — bailing after step 1 just means they re-click the link and go through /accept-invite/start again (idempotent password update).

post/accept-invite/start

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/accept-invite/start
  • Auth: none declared

Headers

API-Version'1'

Major API version. Omit or send 1 for the current v1 surface. Retired operations use RFC 9745 Deprecation and RFC 8594 Sunset headers.

Request body

tokenstring required
passwordstring required

Response

Successful Response

OR

Changes

No recorded changes to this operation across all 1 revision of this API.