API reference · Identity and tokens
Invite an email with a role
POST
/v1/orgs/{org}/invitationsInvite an email with a role. The link is returned once and mailed
- Permission
iam.invitations.manage- Budget
- 30 requests in 60 s per organization, shared as
iam.invitations - Audit log
iam.invitation.create- Operation
iam.invitations.create
Parameters
| Name | In | Type | Required | Notes |
|---|---|---|---|---|
org | path | string | yes | for example "org_01h455vb4pex5vsknk084sn02q" |
Idempotency-Key | header | string | no | One key per intended mutation. A retry with the key never executes twice; its response carries a secret and is not replayed: a duplicate answers 409 idempotency_outcome_committed. For example "01h455vb4pex5vsknk084sn02q" |
x-obhut-management-assignment | header | string | no | Select one staff assignment. Direct membership remains the default. Bound API tokens use their stored source and ignore this selector. For example "masg_01h455vb4pex5vsknk084sn02q" |
Request body
| Field | Type | Required | Notes |
|---|---|---|---|
email | string | yes | 0 to 254 characters |
role | string | yes | one of "owner", "admin", "member" |
language | string | no | one of "en", "de"; default "en" |
Response 201
| Field | Type | Required | Notes |
|---|---|---|---|
invitation | object | yes | |
invitation.id | string | yes | for example "inv_01h455vb4pex5vsknk084sn02q" |
invitation.email | string (email) | yes | |
invitation.role | string | yes | one of "owner", "admin", "member" |
invitation.invitedBy | string or null | yes | |
invitation.createdAt | string (date-time) | yes | UTC, ISO 8601. |
invitation.expiresAt | string (date-time) | yes | UTC, ISO 8601. |
invitation.expired | boolean | yes | |
acceptUrl | string (uri) | yes | Single use. Shown once, never stored in clear. |
mailed | boolean | yes |