Fac-360
Organizations

Withdraw an invitation

An invitation lives a week. Without this, an invitation sent to a mistyped address is live for all of it.

DELETE
/console/v1/organizations/{organizationId}/invitations/{invitationId}

An invitation lives a week. Without this, an invitation sent to a mistyped address is live for all of it.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

organizationId*string
Formatuuid
invitationId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/invitations/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Authorization: Bearer apf_v2_tu_credencial"
Empty

Invite somebody POST POST

ADMIN and above, and nobody may invite above their own rank: an ADMIN who could mint an OWNER is an ADMIN who can promote themselves through a second account. The invitation is bound to the address it names, so a forwarded link is worth nothing to anybody else.

Accept an invitation POST POST

Requires a live session whose verified address is the one the invitation was sent to. Accepting with a different account would turn a leaked link into a way into someone else's organization. An invitation for somebody who is already a member is spent without changing the role they already have.