Fac-360
Organizations

Accept an invitation

Requires a live session whose verified address is the one the invitation was sent to. Accepting with a different account would turn a leaked link into a way into someone else's organization. An invitation for somebody who is already a member is spent without changing the role they already have.

POST
/console/v1/invitations/acceptance

Requires a live session whose verified address is the one the invitation was sent to. Accepting with a different account would turn a leaked link into a way into someone else's organization. An invitation for somebody who is already a member is spent without changing the role they already have.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/console/v1/invitations/acceptance" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "token": "stringst"  }'
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "memberRole": "OWNER"}