Invitations
Token-based endpoints for accepting an organization invite
When an org admin sends an invite (see Organizations → Invitations), the recipient receives a link containing a one-time token. These endpoints let the recipient inspect and accept that invitation.
Resource overview
GET
/api/invitations/{token}PublicPOST
/api/invitations/{token}/acceptSessionInspect invitation
GET
/api/invitations/{token}PublicPublic — no auth required. Used by the accept page to render the org name, inviter, and assigned role before the recipient signs in.
200
{
"organizationName": "Acme Tours",
"inviterName": "Jane Doe",
"email": "newhire@example.com",
"role": "coordinator",
"expiresAt": "2026-06-01T00:00:00Z"
}404Token is invalid, expired, or already used.
{ "error": "Invitation not found" }Accept invitation
POST
/api/invitations/{token}/acceptSessionRequires the recipient to be signed in with the email the invitation was sent
to. On success, creates the OrganizationMember record and consumes the
token.
200
{ "success": true, "organizationId": "org-uuid" }