postAccept user invitation

Public endpoint — no Bearer token required. The invitation recipient submits (invitation_id, challenge_ref) received via the magic-link e-mail. On success the response contains a short-lived session_token that the client can use for a platform session.

Request

Request URL

POST
POST /user-invitations/accept

Request Body

application/json
{
  "challenge_ref": "challenge-ref-0001",
  "invitation_id": "b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b"
}

Responses

Response

application/json
{
  "actor_scope_ref": "enterprises/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
  "enterprise_ref": "enterprises/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
  "invitation": {
    "accepted_at": "2026-05-01T10:00:00Z",
    "cancelled_at": null,
    "challenge_ref": null,
    "created_at": "2026-05-01T10:00:00Z",
    "email_constraint": "jane.doe@acme.example",
    "enterprise_ref": "enterprises/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "etag": "W/\"a1b2c3d4\"",
    "expires_at": "2026-05-01T10:00:00Z",
    "id": "b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "invited_by": "users/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "pending_human_actor_ref": "users/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "role": "roles/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "scope": "enterprises/b8e2f1a0-4c3d-4e5f-9a1b-2c3d4e5f6a7b",
    "status": "accepted",
    "updated_at": "2026-05-01T10:00:00Z"
  },
  "session_expires_at": "2026-05-01T10:00:00Z",
  "session_token": "sess_eyJhbGciOiJSUzI1NiJ9.payload.sig"
}

Resource created successfully.