Invite a team member
curl --request POST \
--url https://posted-api.example.com/api/auth/invitations \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie posted_session= \
--data '
{
"email": "jsmith@example.com"
}
'import requests
url = "https://posted-api.example.com/api/auth/invitations"
payload = { "email": "jsmith@example.com" }
headers = {
"cookie": "posted_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'posted_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({email: 'jsmith@example.com'})
};
fetch('https://posted-api.example.com/api/auth/invitations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/api/auth/invitations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'jsmith@example.com'
]),
CURLOPT_COOKIE => "posted_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/api/auth/invitations"
payload := strings.NewReader("{\n \"email\": \"jsmith@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "posted_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/api/auth/invitations")
.header("cookie", "posted_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"jsmith@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/api/auth/invitations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'posted_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"jsmith@example.com\"\n}"
response = http.request(request)
puts response.read_body{
"invitation": {
"id": "66666666-6666-4666-8666-666666666666",
"email": "sam@example.test",
"role": "member",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": "2027-01-18T09:30:00.000Z"
},
"token": "example-private-invitation-token",
"inviteUrl": "https://posted.example.test/invite?token=example",
"emailDelivery": "queued"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}Invite a team member
Creates an invitation and revokes older unused invitations for the same email. Returns its token and inviteUrl once, and queues email if SMTP is configured.
POST
/
api
/
auth
/
invitations
Invite a team member
curl --request POST \
--url https://posted-api.example.com/api/auth/invitations \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie posted_session= \
--data '
{
"email": "jsmith@example.com"
}
'import requests
url = "https://posted-api.example.com/api/auth/invitations"
payload = { "email": "jsmith@example.com" }
headers = {
"cookie": "posted_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'posted_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({email: 'jsmith@example.com'})
};
fetch('https://posted-api.example.com/api/auth/invitations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/api/auth/invitations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'jsmith@example.com'
]),
CURLOPT_COOKIE => "posted_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/api/auth/invitations"
payload := strings.NewReader("{\n \"email\": \"jsmith@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "posted_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/api/auth/invitations")
.header("cookie", "posted_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"jsmith@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/api/auth/invitations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'posted_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"jsmith@example.com\"\n}"
response = http.request(request)
puts response.read_body{
"invitation": {
"id": "66666666-6666-4666-8666-666666666666",
"email": "sam@example.test",
"role": "member",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": "2027-01-18T09:30:00.000Z"
},
"token": "example-private-invitation-token",
"inviteUrl": "https://posted.example.test/invite?token=example",
"emailDelivery": "queued"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.
Creates an invitation and revokes older unused invitations for the same email. Returns its token and inviteUrl once, and queues email if SMTP is configured.
Request conventions · API keys · MCP connections
Authorizations
Signed-in human browser session; mutation requests also need the exact UI Origin
Headers
The exact configured Posted UI origin. Required for browser mutations carrying session cookies.
Body
application/json
Was this page helpful?
