---
title: "Validate Invitation"
method: POST
path: "/v1/invitations/validate"
tags: ["invitations"]
---

# Validate Invitation

`POST /v1/invitations/validate`

Look up a pending invitation by its token, for the accept page to render before committing.

A ``POST`` with the token in the body, not a ``GET`` with it in the URL:
the token is a bearer credential, and a URL path is what an access log or
an intermediate proxy routinely retains.

## Request body

- ValidateInvitationRequest — The preview lookup's body. A ``POST`` with the token in the body rather than a ``GET`` with it in the URL, matching ``AcceptInvitationRequest``: the token is a bearer-style credential (see ``Invitation.token_hash``'s docstring), and a URL is one a proxy or an access log routinely retains, which a request body is not.
  - `token` string, required

## Response `200`

Successful Response

- InvitationPreviewPublic — What an unauthenticated visitor sees before committing to accept. Deliberately narrow: the address it was sent to, the organization's name, and the role on offer. The token is the caller's only credential here, not a session, so this carries nothing that identifies who sent it or any other member.
  - `email` string, required
  - `expires_at` string, date-time, required
  - `organization_name` string, required
  - `role` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.net/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/91764f0b41d6/schema)