Harthelm Docs
REST APIInvites

Accept an invitation

The caller's verified email must be the invited one (403 `invite-email-mismatch`); a team invitation makes the caller a member of the organization first. 409 `invite-invalid` when it was revoked, has expired, or was accepted by someone else or by the caller who has left its target since; the caller's own acceptance answers 200 again.

Generated from openapi/harthelm.yaml at v1.5.0
POST
/me/invites/{invite}/accept

Authorization

cookie__Host-harthelm_session<token>

Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header Harthelm-CSRF: 1 and a matching Origin.

Path Parameters

invite*string

An invitation's id.

Formatuuid

Response Body

The accepted invitation.

application/json
  1. response
id*string
Formatuuid
email*string
org_id*string
Formatuuid
org_name?string
team_id?ID

Absent for an organization invitation.

Formatint64
Range1 <= value
team_name?string
role*string

owner or member for an organization invitation, admin or member for a team invitation.

Value in"owner""admin""member"
invited_by?

A user as member lists show them.

state*InviteState
Value in"pending""accepted""revoked""expired"
mail*InviteMailState

off: mail is not configured, copy the link instead.

Value in"off""queued""sent""failed"
created_at*string
Formatdate-time
expires_at*string
Formatdate-time
accepted_at?string
Formatdate-time
curl -X POST 'https://console.example.com/api/v1/me/invites/497f6eca-6276-4993-bfeb-53cbbbba6f08/accept'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "email": "string",  "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",  "org_name": "string",  "team_id": 1,  "team_name": "string",  "role": "owner",  "invited_by": {    "id": 1,    "name": "string",    "email": "string",    "picture_url": "string"  },  "state": "pending",  "mail": "off",  "created_at": "2019-08-24T14:15:22Z",  "expires_at": "2019-08-24T14:15:22Z",  "accepted_at": "2019-08-24T14:15:22Z"}

Accept an invitation by its link's token

The console's `/invite/<token>` page posts the token after sign-in. The caller's verified email must be the invited one (403 `invite-email-mismatch`): the link is a way in, not a credential. 409 `invite-invalid` for an unknown token or an invitation that was revoked, has expired, or was accepted by someone else (or by the caller who has left its target since). The sign-in accepts pending invitations of the verified email before this page posts, so the caller's own acceptance answers 200 again with the same invitation.

Invite someone to an organization

Organization owners (`org.members`); role `owner` or `member`. The answer carries the invitation link once (`url`), to copy when mail is off; with mail on, the link goes out by mail too. The invitation expires after 7 days. 409 `already-member`, `already-invited` (resend or revoke the pending one); 429 when the caller is over the per-sender mail limit.