Accept an invitation addressed to you
Accepting is the invited person's own act — IN-341. **This takes a plain signed-in user, not a business context, and that is the whole fix.** It used to depend on `require_permission`, which resolves through `get_business_context`, which refuses a member who is not yet ACTIVE. The only way to become scoped to a business is `/context/switch`, which refuses that same member with "Accept your invitation first". The endpoint could only ever be reached by somebody who had already accepted. The token identifies both the invitation and the business, so nothing is taken from the caller but their identity.
Accepting is the invited person's own act — IN-341.
This takes a plain signed-in user, not a business context, and that is
the whole fix. It used to depend on require_permission, which resolves
through get_business_context, which refuses a member who is not yet
ACTIVE. The only way to become scoped to a business is /context/switch,
which refuses that same member with "Accept your invitation first". The
endpoint could only ever be reached by somebody who had already accepted.
The token identifies both the invitation and the business, so nothing is taken from the caller but their identity.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The token from the emailed link.
Named for what it accepts rather than just AcceptRequest, because
app/domain/disputes/routes.py already has one of those. Two schemas
sharing a name makes FastAPI fully qualify both, and which one keeps the
short name depends on import order — so the generated spec differs between
machines and the --check in CI fails for whoever regenerates next.
It carries the business too, which is why nothing here names one: taking a
business_id from the caller would let somebody with any valid token ask
to join a different business.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/b/v1/members/invitations/accept" \ -H "Content-Type: application/json" \ -d '{ "token": "kZ3nQ1p7Xw2vR8sT4uY6bN0mL5jH9gF" }'{ "member": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "role": "owner", "status": "invited", "invited_by": "0fdabe0c-eb7c-440a-96d2-2c65906c3777", "full_name": "string", "email": "string", "phone_number": "string" }, "business_id": "f59fcbb7-848d-4242-af07-a8bb7e3ab37c", "business_name": "string", "access_token": "string", "token_type": "bearer", "expires_in_minutes": 0}