---
title: "Invite a User"
method: POST
path: "/v2/users/invite"
tags: ["Users"]
---

# Invite a User

`POST /v2/users/invite`

Create a User and invite them to the system

## Request body

- InviteUserRequest
  - `email` string, email, required — the email address of the invited user
  - `mfaType` 'SMS' | 'YUBIKEY' | 'TOTP', required — <p>The MFA type that the user will use</p> <p>The type may be conditional on the role(s) the user has</p>
  - `smsNumber` string, required — The phone number of a device that the user can receive sms messages on
  - `primaryContactNumber` string, required — The main contact number for the user
  - `secondaryContactNumber` string, nullable — The secondary contact number for the user
  - `roles` string[], required — The role(s) for the user The role must exist The role can be a custom role or a system role but the invoker must have the permissions to assign the role System roles are: velo.backoffice.admin, velo.payor.master_admin, velo.payor.admin, velo.payor.support, velo.payee.admin, velo.payee.support
  - `firstName` string
  - `lastName` string
  - `entityId` string, uuid, nullable — The payorId or payeeId or null if the user is a backoffice admin
  - `userType` 'BACKOFFICE' | 'PAYOR' | 'PAYEE' — Will default to PAYOR if not provided but entityId is provided
  - `verificationCode` string, nullable — Optional property that MUST be suppied when manually verifying a user The user's smsNumber is registered via a separate endpoint and an OTP sent to them

## Response `204`

No Content. The user was invited successfully

## Other responses

- `400` — Invalid request. See Error message payload for details of failure
- `401` — Invalid access token. May be expired or invalid
- `403` — The authentication does not have permissions to access the resource This usually occurs when there is a valid authentication instance (client or user) but they do not have the required permissions
- `409` — The request contained data that would result in a duplicate value
- `412` — The request could not be completed as a precondition was not met

## Changes

- **2021-11-03** `12abf05c40fa` — 1 info
  - added the new optional request property `userType`
- **2020-09-25** `dd71433847a6` — 5 breaking, 30 info
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `400`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `401`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `403`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `409`
  - …31 more
- **2020-08-13** `75bb7af5ae63` — 3 warning
  - changed the pattern of the request property `primaryContactNumber` from `^\+?[1-9]\d{1,14}$` to `^\+[1-9]\d{1,14}$`
  - changed the pattern of the request property `secondaryContactNumber` from `^\+?[1-9]\d{1,14}$` to `^\+[1-9]\d{1,14}$`
  - changed the pattern of the request property `smsNumber` from `^\+?[1-9]\d{1,14}$` to `^\+[1-9]\d{1,14}$`
- **2020-06-24** `aded220b0d7b` — 2 breaking
  - the response's body type/format changed from `object`/`` to ``/`` for status `412`
  - the `errors/items/` response's property type/format changed from `object`/`` to ``/`` for status `412`
- **2020-02-27** `7c8cfeb59952` — 2 breaking
  - the response's body type/format changed from `object`/`` to ``/`` for status `409`
  - the `errors/items/` response's property type/format changed from `object`/`` to ``/`` for status `409`

[Full history](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/changes/v2/users/invite/post.md)

---

[API](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis.md) · [All operations](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/velopaymentsapi/velo-payments-apis/revisions/05c3f09fc50a/schema)
