Management API
Invitations
Invite people by a one-time link, list and revoke invitations, preview and accept them.
Creating an invitation returns its token exactly once; only a hash is stored. A token works once and for 7 days. Preview and accept take the token in the JSON body, never in a URL, and answer the same 404 for unknown, expired, revoked and used tokens.
Acceptance is by possession of the token, and it never lowers a role the user already has.
Operations
| Operation | Request | Who may call it |
|---|---|---|
| createInvitation | POST /api/orgs/{org}/invitations | admin or above |
| listInvitations | GET /api/orgs/{org}/invitations | admin or above |
| revokeInvitation | DELETE /api/orgs/{org}/invitations/{id} | admin or above |
| previewInvitation | POST /api/invitations/preview | any signed-in user with the token |
| acceptInvitation | POST /api/invitations/accept | any signed-in user with the token |
Management API requests carry a user token and are checked against the caller’s organization role. Delivery API requests carry an SDK key; the two never cross. Errors are always { error: { code, message } }.