---
title: "Invite a user by email."
method: POST
path: "/invite"
tags: ["admin"]
---

# Invite a user by email.

`POST /invite`

Sends an invitation email which contains a link that allows the user to sign-in.

## Request body

- object
  - `email` string, required
  - `data` object

## Response `200`

An invitation has been sent to the user.

- UserSchema — Object describing the user related to the issued access and refresh tokens.
  - `id` string, uuid
  - `aud` string
  - `role` string
  - `email` string — User's primary contact email. In most cases you can uniquely identify a user by their email address, but not in all cases.
  - `email_confirmed_at` string, date-time
  - `phone` string, phone — User's primary contact phone number. In most cases you can uniquely identify a user by their phone number, but not in all cases.
  - `phone_confirmed_at` string, date-time
  - `confirmation_sent_at` string, date-time
  - `confirmed_at` string, date-time
  - `recovery_sent_at` string, date-time
  - `new_email` string, email
  - `email_change_sent_at` string, date-time
  - `new_phone` string, phone
  - `phone_change_sent_at` string, date-time
  - `reauthentication_sent_at` string, date-time
  - `last_sign_in_at` string, date-time
  - `app_metadata` object
  - `user_metadata` object
  - `factors` MFAFactorSchema[]
    - `id` string, uuid
    - `status` string — Usually one of: - verified - unverified
    - `friendly_name` string
    - `factor_type` string — Usually one of: - totp - phone - webauthn
    - `webauthn_credential` string
    - `phone` string, phone, nullable
    - `created_at` string, date-time
    - `updated_at` string, date-time
    - `last_challenged_at` string, date-time, nullable
  - `identities` IdentitySchema[]
    - `identity_id` string, uuid
    - `id` string, uuid
    - `user_id` string, uuid
    - `identity_data` object
    - `provider` string
    - `last_sign_in_at` string, date-time
    - `created_at` string, date-time
    - `updated_at` string, date-time
    - `email` string, email
  - `banned_until` string, date-time
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `deleted_at` string, date-time
  - `is_anonymous` boolean

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `422` — User already exists and has confirmed their address.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)