Skip to main content
POST
Create Invite
Dashboard session only — outside the API key scope catalog, so an API key gets 403 API_KEY_SCOPE_DENIED. A leaked key that could create invites would leave behind access that outlives revoking the key. Invite codes are gone; this is the only way to bring someone in (besides transfer-ownership, which is for existing members).
Requires members:manage.
The token is 32 random bytes, base64url-encoded. The database stores only its SHA-256 hash — the plaintext token appears exactly once, in this response’s url field for a link invite, and is never logged. The invite row is written before the e-mail is sent: if SMTP is down, you still get a 200 with the invite — losing the invite because the mail provider hiccupped would be worse than a delayed e-mail.

Path

string
required
Workspace ID.

Body — e-mail invite

'email'
required
string
required
Compared case-insensitively and Unicode-normalized (NFKC) on both sides, so [email protected] and its decomposed-Unicode twin are the same address. Expires in 7 days. Only one pending invite per (workspace, e-mail) — inviting the same address again refreshes the row and resends the e-mail. A pending e-mail invite counts toward the plan’s member cap.
string
required
Must belong to this workspace.
number
1–365. Access expiry applied to the member once they accept. Omitted = no expiry.
'link'
required
string
required
Must belong to this workspace.
number
1–1000. Omitted = unlimited uses.
number
1–365. Applied to every member who joins through this link. Omitted = no expiry. The link itself is a fixed 24 hours, regardless of this field.

Response

APIWorkspaceInviteCreated
Same shape as List Invites, plus:
string | null
The invite URL. Only present for kind: \"link\", and only in this response — it’s never returned again.

Errors