XISUITEDokumentation

Invitations

Organization and space invitation management (CRUD, accept, resend) 8 Endpunkte. Basis-URL: https://xapi.ambertech.cloud/api/v1

List organization invitations#

GET/invitationsToken

Returns a paginated list of all invitations for the current user's organization. Requires `can_invite_users` permission.

Parameter

NameOrtTypBeschreibung
pageQuerynumber

Page number (default: 1)

limitQuerynumber

Items per page (default: 50, max: 100)

Antworten

  • 200Paginated invitation list
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/invitations" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Create organization invitation#

POST/invitationsToken

Invites a new user to the organization. Requires `can_invite_users` permission. Generates a secure token, creates the invitation record, and sends an email.

Request-Bodyapplication/jsonCreateInvitationDto

NameTypBeschreibung
emailPflichtstring

Email address of the person to invite

Beispiel: invitee@example.com

firstNamePflichtstring

First name of the invitee

Beispiel: John

lastNamePflichtstring

Last name of the invitee

Beispiel: Doe

rolestring

Role to assign (defaults to member)

Werte: memberadminviewer

Beispiel: member

Antworten

  • 200Invitation created and email sent
  • 400User already exists or invitation already pending
  • 403Insufficient permissions
  • 503Invitation email could not be sent (code: email_send_failed) — the invitation is kept; use resend once mail delivery is fixed
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/invitations" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"invitee@example.com","firstName":"John","lastName":"Doe"}'

Delete an invitation#

DELETE/invitations/{id}Token

Permanently deletes a pending or expired invitation. Requires `can_invite_users` permission.

Parameter

NameOrtTypBeschreibung
idPflichtPfadstring

Invitation UUID

Antworten

  • 200Invitation deleted
  • 403Wrong organization
  • 404Invitation not found
Beispiel (cURL)
curl -X DELETE "https://xapi.ambertech.cloud/api/v1/invitations/{id}" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Accept an invitation#

POST/invitations/{id}/acceptÖffentlich

Accepts a pending invitation using the secure token. For space invitations, creates the space membership and applies custom permissions. Also syncs notification status. Rate-limited to 10 req/min.

Parameter

NameOrtTypBeschreibung
idPflichtPfadstring

Invitation UUID

Request-Bodyapplication/jsonAcceptInvitationDto

NameTypBeschreibung
tokenPflichtstring

Secure invitation token received via email

Beispiel: a1b2c3d4e5f6...

passwordstring

Password to set for first-time invited users

Beispiel: Admin@123

Antworten

  • 200Invitation accepted successfully
  • 400Invitation expired or no longer pending
  • 403Invalid invitation token
  • 404Invitation not found
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/invitations/{id}/accept" \
  -H "Content-Type: application/json" \
  -d '{"token":"a1b2c3d4e5f6..."}'

Resend invitation email#

POST/invitations/{id}/resendToken

Generates a new secure token, updates the expiry to 7 days, and resends the invitation email. Requires `can_invite_users` permission.

Parameter

NameOrtTypBeschreibung
idPflichtPfadstring

Invitation UUID

Antworten

  • 200Invitation resent successfully
  • 400Invitation already accepted
  • 403Wrong organization
  • 404Invitation not found
  • 503Invitation email could not be sent (code: email_send_failed) — retry resend once mail delivery is fixed
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/invitations/{id}/resend" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Revoke an invitation#

POST/invitations/{id}/revokeToken

Marks a pending invitation as revoked. Requires `can_invite_users` permission.

Parameter

NameOrtTypBeschreibung
idPflichtPfadstring

Invitation UUID

Antworten

  • 200Invitation revoked
  • 400Invitation already accepted
  • 403Wrong organization
  • 404Invitation not found
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/invitations/{id}/revoke" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Look up invitation by token#

GET/invitations/by-tokenÖffentlich

Public endpoint to retrieve invitation details by the secure token. Used by the frontend accept-invitation page. Rate-limited to 10 req/min.

Parameter

NameOrtTypBeschreibung
tokenPflichtQuerystring

The secure invitation token from the email link

Antworten

  • 200Invitation details with organization and space names
  • 404Invitation not found
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/invitations/by-token"

List pending org-level invitations for the current user#

GET/invitations/mineToken

Returns pending, non-expired, org-level invitations matching the authenticated user's email. Used by the onboarding empty-state. Does NOT return tokens (security).

Antworten

  • 200Pending invitations array
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/invitations/mine" \
  -H "Authorization: Bearer $XISUITE_TOKEN"
Stand: 25. Oktober 2026© 2026 XISUITE · AmberTech Solutions