Cancel an outstanding invitation
Kill the link. An Owner who invited the wrong address had no way to undo it before this, and waiting seven days is not an answer when the typo landed at a competitor's domain.
Kill the link. An Owner who invited the wrong address had no way to undo it before this, and waiting seven days is not an answer when the typo landed at a competitor's domain.
Authorization
OAuth2PasswordBearer In: header
Path Parameters
uuidCookie Parameters
Response Body
application/json
curl -X DELETE "https://example.com/api/b/v1/members/invitations/497f6eca-6276-4993-bfeb-53cbbbba6f08"Invite somebody into the business POST
Invite the holder of an email address — IN-341. This used to resolve the address to an existing account and refuse if there was none, which meant the common case at a growing business, a colleague who has never heard of us, could not be invited at all. An invitation is now its own record keyed to the address, so no account has to exist yet. Re-inviting an address that already has an invitation outstanding revokes the old one and sends a fresh link. That is also the only way to resend, because the token is hashed and the original can never be shown again.
Accept an invitation addressed to you POST
Accepting is the invited person's own act — IN-341. **This takes a plain signed-in user, not a business context, and that is the whole fix.** It used to depend on `require_permission`, which resolves through `get_business_context`, which refuses a member who is not yet ACTIVE. The only way to become scoped to a business is `/context/switch`, which refuses that same member with "Accept your invitation first". The endpoint could only ever be reached by somebody who had already accepted. The token identifies both the invitation and the business, so nothing is taken from the caller but their identity.