Joins the organisation of an invitation and signs in. A person without an account gets one.
HTTP
POST /auth/invites/{token}/acceptAccess: No token needed.
Path parameters #
| Parameter | Description |
|---|---|
token | The token from the invitation link. |
Request body #
JSON.
| Field | Type | Required | Description |
|---|---|---|---|
name | string | yes | The name for a new account. At most 80 characters. Ignored when the address already has an account. |
password | string | yes | The password for a new account, at least 8 characters. When the address already has an account, it must be that account’s password. |
JSON
{ "name": "Grace Hopper", "password": "correct horse battery" }Response 201 #
The person joined the organisation and a session started.
JSON
{
"token": "9f2c...e1",
"expiresAt": "2026-10-23T09:30:00+00:00",
"user": {
"id": "0197a3c2-5b1e-7c4a-9d2f-3e8b6a1f0c55",
"email": "ada@example.com",
"name": "Ada Lovelace",
"locale": "en-GB"
}
}Response fields #
| Field | Type | Description |
|---|---|---|
token | string | The session token. Send it as Authorization: Bearer <token>. It is shown only once. |
expiresAt | string | When the token expires, as an ISO 8601 timestamp. A token lasts 7 days. |
user.id | string | The id of the user. |
user.email | string | The email address. |
user.name | string | The name. |
user.locale | string or null | The interface language the user picked, for example en-GB, or null until they pick one. |
Errors #
| Status | error | When |
|---|---|---|
| 410 | invalid_or_expired_token | The token is unknown or has expired. |
| 403 | wrong_password | The address already has an account and the password is not its password. |
| 422 | invalid_request | password is too_short (shorter than the minimum of the inviting organisation, at least 8) or too_weak (the organisation requires upper case, lower case and a digit). The rules apply to new accounts. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.