AssetCenter
/api/v1/invitations
Invite an organization user
Invite a user or add a social-login member to the API key’s organization.
Last updated
Request
POST /api/v1/invitations
Requires users:invite. See token permissions. The token creator must remain an active administrator of the token’s organization.
Send Authorization: Bearer YOUR_API_TOKEN and Accept: application/json.
Query parameters
This endpoint does not use query parameters.
Request body
| Field | Type | Usage |
|---|---|---|
email |
string | Required. A valid email address, up to 255 characters. Stored in lowercase. |
Requires Idempotency-Key. Use a unique key for each action and keep it unchanged when retrying. Successful responses are remembered for 24 hours per token. Idempotency and retries.
Example
Set ASSETCENTER_API_TOKEN as described in the quick start. Replace example IDs with values from your organization.
curl --request POST "https://my.assetcenter.app/api/v1/invitations" \
--header "Authorization: Bearer $ASSETCENTER_API_TOKEN" \
--header "Accept: application/json" \
--header "Idempotency-Key: $(uuidgen)" \
--header "Content-Type: application/json" \
--data '{"email":"[email protected]"}'
Response
201 Created. Illustrative response; IDs and values will differ.
{
"data": {
"status": "invitation_created",
"invitation": {
"id": 81,
"email": "[email protected]",
"expired": false,
"expires_at": "2026-09-08T16:00:00.000000Z",
"created_at": "2026-09-07T16:00:00.000000Z"
}
}
}
Behavior and constraints
Password-login organizations create an invitation valid for 24 hours and send an acceptance email. The response has status: invitation_created and an invitation object.
Google and Microsoft organizations add the user directly as a non-administrator. The response instead has status: member_added and a user object with the same fields as Get an organization user. Existing user profiles, other memberships, and selected organizations are preserved. A new account uses the email’s local part as its name and the creator’s timezone (or UTC). A welcome email is sent. Existing inactive users remain inactive.
The plan must have room for another user; unexpired invitations also count toward usage. Existing members and duplicate unaccepted invitations, including expired invitations, return 422. Resend or revoke an existing invitation instead.
Email is attempted after the membership or invitation is saved. A successful response confirms the saved change, not delivery. Delivery failures are logged; use resend if an invitation email is missing. Replays return the original response and do not send another email. There is no request_id body field; use Idempotency-Key.
Creation is limited to 20 requests per minute per token. Creation and resend share an additional 60-request-per-minute organization limit. Invitation responses contain id, email, expired, expires_at, and created_at. Dates are UTC ISO 8601 strings. Invitation tokens and acceptance URLs are never returned.
Errors
401 means the customer bearer token is missing, expired, revoked, or invalid. 403 means the token lacks the required permission or its creator is no longer an active administrator. 404 means the requested member or invitation is unavailable in this organization. 422 identifies invalid or unsupported input, plan limits, or a protected membership change. 409 indicates conflicting key reuse or a concurrent organization change. 429 means a rate limit was reached. Error handling and rate limits.