Skip to main content
POST
Invite a person

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
email
string
required
Required string length: 3 - 320
roles
BindingIn · object[]
required
Required array length: 1 - 32 elements
password
string | null

Optional. Without it the person receives an invitation: a single-use link to choose a password, then the authenticator at the first sign-in. A person whose e-mail domain belongs to the tenant's SSO gets no invitation and signs in through the identity provider.

Required string length: 12 - 1024
with_totp
boolean
default:true

Only with password: creates the authenticator secret now and returns it in totp_uri. Without a password the person sets up the authenticator at the first sign-in.

Response

The person, with the invitation (shown once) when created without a password.

active
boolean
required
created_at
string<date-time>
required
email
string
required
password_set
boolean
required

False while an invited person has not chosen a password.

roles
BindingOut · object[]
required
sso
boolean
required

The e-mail domain belongs to the tenant's SSO connection.

user_id
string<uuid>
required
deactivated_at
string<date-time> | null
invitation
InvitationOut · object | null

Shown once: at creation, for a person created without a password.

invitation_expires_at
string<date-time> | null

Until when the person's open invitation link works; null when none is open.

last_login_at
string<date-time> | null
last_sso_login_at
string<date-time> | null
recovery_codes_left
integer
default:0
second_factor_confirmed_at
string<date-time> | null

When the authenticator in use was confirmed; null while there is none.

totp_uri
string | null

Shown once, at creation, for enrollment.