6 endpoints.
| Method | Path | Summary |
|---|---|---|
GET | /api/invitations/{communityId}/invitations | Get all invitations for a community (admin/moderator) |
POST | /api/invitations/{communityId}/invitations | Create an invitation (admin/moderator) |
DELETE | /api/invitations/{communityId}/invitations/{invitationId} | Cancel an invitation (admin/moderator) |
POST | /api/invitations/{communityId}/invitations/{invitationId}/resend | Resend an invitation (admin/moderator) |
POST | /api/invitations/accept | Accept invitation and set password (public) |
GET | /api/invitations/verify | Verify invitation token and get details (public) |
GET /api/invitations/{communityId}/invitationsReturns a paginated list of community invitations, filterable by status. Auth: Bearer JWT required.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
communityId | path | yes | string (uuid) | — |
page | query | no | integer | — |
limit | query | no | integer | — |
status | query | no | enum: PENDING, APPROVED, REJECTED, LEFT | — |
Responses
| Status | Description | Body |
|---|---|---|
200 | Paginated list of invitations | object |
401 | Authentication required | — |
403 | Permission denied | — |
POST /api/invitations/{communityId}/invitationsInvites a user to join the community. If the email belongs to an existing user, they receive an invitation link. If not, a new user account is created.
Re-invitation: If the user was previously removed (LEFT) or rejected (REJECTED), their existing member record is updated back to PENDING status.
Permissions: Requires users:manage or users:moderate.
Invitation token is hashed (SHA-256) before storage; raw token sent via email only.
Auth: Bearer JWT required.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
communityId | path | yes | string (uuid) | UUID of the community |
Request body (required) — multipart/form-data
| Field | Type | Required | Description |
|---|---|---|---|
email | string (email) | yes | Email of the user to invite |
firstName | string | no | — |
familyName | string | no | — |
role | enum: MEMBER, MODERATOR, COMMUNITY_ADMIN | no | — |
message | string | no | Optional personal message included in invitation email |
avatar | string (binary) | no | Optional avatar image for new user |
Responses
| Status | Description | Body |
|---|---|---|
201 | Invitation created and email sent | object |
400 | Bad request - missing email, invalid data, or user already an active member | — |
401 | Authentication required | — |
403 | Permission denied - requires users:manage or users:moderate | — |
404 | Community not found | — |
500 | Internal server error | — |
DELETE /api/invitations/{communityId}/invitations/{invitationId}Cancels a pending invitation. The invitation link will no longer be valid. Auth: Bearer JWT required.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
communityId | path | yes | string (uuid) | — |
invitationId | path | yes | string (uuid) | UUID of the invitation (community member record ID) |
Responses
| Status | Description | Body |
|---|---|---|
200 | Invitation cancelled | object |
401 | Authentication required | — |
403 | Permission denied | — |
404 | Invitation not found | — |
500 | Internal server error | — |
POST /api/invitations/{communityId}/invitations/{invitationId}/resendResends an invitation email with a fresh token. Can also reactivate invitations for members who were previously REJECTED or LEFT, setting their status back to PENDING.
Auth: Bearer JWT required.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
communityId | path | yes | string (uuid) | — |
invitationId | path | yes | string (uuid) | UUID of the invitation to resend |
Responses
| Status | Description | Body |
|---|---|---|
200 | Invitation resent successfully | object |
401 | Authentication required | — |
403 | Permission denied | — |
404 | Invitation not found | — |
500 | Internal server error | — |
POST /api/invitations/acceptAuth: Bearer JWT required.
Request body (required) — application/json
| Field | Type | Required | Description |
|---|---|---|---|
token | string | yes | — |
password | string | yes | — |
Responses
| Status | Description | Body |
|---|---|---|
200 | Invitation accepted | — |
GET /api/invitations/verifyAuth: Bearer JWT required.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
token | query | yes | string | — |
Responses
| Status | Description | Body |
|---|---|---|
200 | Invitation details | — |