v2

latestOpenAPI 3.1.02026-08-05267431678.1 KB

teams

Invite Member

Invite a user to join a team.

Requires owner, admin, or billing role. Owner-role invitations are rejected; ownership can only be transferred to an existing team member. Supports pre-signup invites (invitee doesn't need an account yet).

Accepted risk (ENG-1281): AAL2 enforcement was intentionally removed (PR #3928) — users without MFA enrolled were being blocked from routine team operations. Inviting an attacker-controlled email as admin/billing is the cleanest L-A16 escalation path: the attacker accepts on their own AAL2 account and instantly has MANAGE_BILLING on the victim team. This risk is accepted per the design decision.

post/teams/{team_id}/invitations

Path parameters

team_idstring required

Request body

emailstring email required

Email address of the person to invite

role'owner' | 'billing' | 'admin' | 'editor' | 'viewer'

Team member roles with hierarchical permissions.

Wire DTO mirror of the ORM TeamRoleType enum. Used only for API request/response serialization; authorization decisions route through the ORM matrix (database_tables.permissions), never this enum.

Response

Successful Response

idstring required

team_idstring required

team_namestring required

emailstring required

role'owner' | 'billing' | 'admin' | 'editor' | 'viewer' required

Team member roles with hierarchical permissions.

Wire DTO mirror of the ORM TeamRoleType enum. Used only for API request/response serialization; authorization decisions route through the ORM matrix (database_tables.permissions), never this enum.

status'pending' | 'accepted' | 'declined' | 'expired' required

Status of a team invitation.

invited_bystring required

inviter_namestring nullable

inviter_emailstring nullable

created_atstring required

expires_atstring required

email_sentboolean

Whether the invitation email was successfully handed off to SendGrid. Only meaningful on the create-invite response; list endpoints do not track historical delivery and default to True.