Claim a team invite as a new local account

POST

/api/auth/invite-claim/

curl --request POST \
  --url http://localhost:8000/api/auth/invite-claim/ \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example", "password": "example" }'

• Local development
• Production

Local-auth deployments only (#818): possession of the invite token proves mailbox control, so the invitee sets a password for the invite’s email here, signs in via POST /api/auth/login/, and then accepts the invite through the normal accept endpoint.

404 when the deployment uses Firebase sign-in or the token is unknown; 410 expired/used invite; 409 the email already has a local account (sign in instead). Throttled (10/min).

Authorizations

• None

Request Body^required

Request body for POST /api/auth/invite-claim/ (#818).

object

token

required

Invite token from the email link.

string

>= 1 characters <= 64 characters

password

required

Password the invitee chooses (min 8 chars, not a common password, not all digits).

string

>= 8 characters <= 128 characters

Example^generated

{
  "token": "example",
  "password": "example"
}

Request body for POST /api/auth/invite-claim/ (#818).

object

token

required

Invite token from the email link.

string

>= 1 characters <= 64 characters

password

required

Password the invitee chooses (min 8 chars, not a common password, not all digits).

string

>= 8 characters <= 128 characters

Example^generated

token=example&password=example

Request body for POST /api/auth/invite-claim/ (#818).

object

token

required

Invite token from the email link.

string

>= 1 characters <= 64 characters

password

required

Password the invitee chooses (min 8 chars, not a common password, not all digits).

string

>= 8 characters <= 128 characters

Responses

200

Media typeapplication/json

object

ok

boolean

email

string

Example^generated

{
  "ok": true,
  "email": "example"
}

404

Media typeapplication/json

object

detail

required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Example^generated

{
  "detail": "example"
}

409

Media typeapplication/json

object

detail

required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Example^generated

{
  "detail": "example"
}

410

Media typeapplication/json

object

detail

required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Example^generated

{
  "detail": "example"
}

429

Media typeapplication/json

object

detail

required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Example^generated

{
  "detail": "example"
}