> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Invite a team member

> Creates an invitation and revokes older unused invitations for the same email. Returns its token and inviteUrl once, and queues email if SMTP is configured.

A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.

Creates an invitation and revokes older unused invitations for the same email. Returns its token and inviteUrl once, and queues email if SMTP is configured.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json POST /api/auth/invitations
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /api/auth/invitations:
    post:
      tags:
        - Members and invitations
      summary: Invite a team member
      description: >-
        Creates an invitation and revokes older unused invitations for the same
        email. Returns its token and inviteUrl once, and queues email if SMTP is
        configured.


        A signed-in human administrator is required. API keys and MCP
        credentials cannot replace that session. Sensitive operations can also
        require recent authentication.
      operationId: post_api_auth_invitations
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Posted UI origin. Required for browser
            mutations carrying session cookies.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  maxLength: 320
                  format: email
                  pattern: >-
                    ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
                role:
                  type: string
                  enum:
                    - admin
                    - member
                    - viewer
              required:
                - email
                - role
              additionalProperties: false
      responses:
        '201':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  invitation:
                    type: object
                    properties:
                      id:
                        type: string
                      email:
                        type: string
                      role:
                        type: string
                      createdAt:
                        type: string
                      expiresAt:
                        type: string
                    additionalProperties: true
                  token:
                    type: string
                  inviteUrl:
                    type: string
                  emailDelivery:
                    type: string
                additionalProperties: true
              example:
                invitation:
                  id: 66666666-6666-4666-8666-666666666666
                  email: sam@example.test
                  role: member
                  createdAt: '2027-01-18T09:30:00.000Z'
                  expiresAt: '2027-01-18T09:30:00.000Z'
                token: example-private-invitation-token
                inviteUrl: https://posted.example.test/invite?token=example
                emailDelivery: queued
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: posted_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.