Create an invitation link

Identity module

POST/invitation-linksinvitationLinks.create

An invitation link with a role and an expiry. The token is shown once. Creates an invitation link. Requires `Idempotency-Key`; a replay returns the original response. The organization is derived from the credential or the parent row, never from the body.

Requires the capability org.members.invite.
OAuth scopes: org.
Send an Idempotency-Key header. A replay with the same key returns the original response.
Error statuses: 400, 401, 409, 422, 429. Errors are RFC 9457 problem details.

Request body: InvitationLinkCreate

invitationLinks.create: InvitationLinkCreate
Field	Type	Required	Description
role	OrgRole	Yes	Platform role in band order (Section 8).Constraints: one of "Owner", "Admin", "Manager", "Member", "Collaborator", "Field", "Viewer"
expires_at	string (date-time)	Yes	When the link expires.
max_uses	integer \| null	No	Maximum uses.Constraints: range 1 to any

{
  "role": "Manager",
  "expires_at": "2026-10-08T14:30:00Z",
  "max_uses": 10
}

Response 201: InvitationLink

invitationLinks.create: InvitationLink
Field	Type	Required	Description
id	string (uuid)	Yes	Identifier of the invitation link.
org_id	string (uuid)	Yes	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Yes	When the row was created.
created_by	string (uuid) \| null	Yes	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Yes	When the row was last updated.
updated_by	string (uuid) \| null	Yes	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
role	OrgRole \| null	Yes
expires_at	string (date-time)	Yes	When the link expires.
max_uses	integer \| null	Yes	Maximum uses.Constraints: range 1 to any
revoked_at	string (date-time) \| null	Yes	When the link was revoked.

{
  "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "created_at": "2026-10-08T14:30:00Z",
  "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "updated_at": "2026-10-08T14:30:00Z",
  "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "role": "Manager",
  "expires_at": "2026-10-08T14:30:00Z",
  "max_uses": 10,
  "revoked_at": "2026-10-08T14:30:00Z"
}

Code samples

curl -X POST "$XOS_BASE_URL/invitation-links" \
  -H "Authorization: Bearer $XOS_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"role":"Manager","expires_at":"2026-10-08T14:30:00Z","max_uses":10}'

const { data } = await xos.invitationLinks.create({
    "role": "Manager",
    "expires_at": "2026-10-08T14:30:00Z",
    "max_uses": 10
  });

response = xos.invitation_links.create({"role": "Manager", "expires_at": "2026-10-08T14:30:00Z", "max_uses": 10})

xos invitation-links create --data '{"role":"Manager","expires_at":"2026-10-08T14:30:00Z","max_uses":10}'