Invite somebody into the business
Invite the holder of an email address — IN-341. This used to resolve the address to an existing account and refuse if there was none, which meant the common case at a growing business, a colleague who has never heard of us, could not be invited at all. An invitation is now its own record keyed to the address, so no account has to exist yet. Re-inviting an address that already has an invitation outstanding revokes the old one and sends a fresh link. That is also the only way to resend, because the token is hashed and the original can never be shown again.
Invite the holder of an email address — IN-341.
This used to resolve the address to an existing account and refuse if there was none, which meant the common case at a growing business, a colleague who has never heard of us, could not be invited at all. An invitation is now its own record keyed to the address, so no account has to exist yet.
Re-inviting an address that already has an invitation outstanding revokes the old one and sends a fresh link. That is also the only way to resend, because the token is hashed and the original can never be shown again.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Invite by address, not by user id.
An Admin knows who they mean by their email; they do not know the person's internal id, and requiring one would mean exposing a user lookup to every business in the platform.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/b/v1/members/invitations" \ -H "Content-Type: application/json" \ -d '{ "email": "aline@meridianlabs.co", "role": "admin" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "email": "string", "role": "owner", "status": "pending", "invited_by": "0fdabe0c-eb7c-440a-96d2-2c65906c3777", "invited_by_name": "string", "expires_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "accepted_at": "2019-08-24T14:15:22Z"}List invitations GET
Outstanding invitations, and recently finished ones, newest first. Separate from `GET /members` because an invitation is no longer a member row. A team screen that wants both asks for both.
Cancel an outstanding invitation DELETE
Kill the link. An Owner who invited the wrong address had no way to undo it before this, and waiting seven days is not an answer when the typo landed at a competitor's domain.