Resend an invite
const url = 'http://localhost:8000/api/clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/resend/';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url http://localhost:8000/api/clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/resend/ \ --header 'Authorization: Bearer <token>'A fresh link for an invite that is pending or expired, valid 14 days; the previous link stops working. A second resend within a minute of the last e-mail sends nothing and answers the grant as it is. The invite rules are checked again (400 minor_athlete_invite / date_of_birth_required, 409 already_on_team). 409 access_active for an accepted grant (under local auth it mails the account a sign-in link instead — 409 email_changed when the account’s address is no longer the invited one), access_revoked for a revoked one. Rate-limited per coach, and to three e-mails per address a day on a card across coaches (429, invite_rate_limited).
A coach of the team, on a card of the active team. Every route answers 404 while client access is switched off on the environment. A partner API key and a client’s own account get 403. 402 trial_expired / access_ended on a read-only team (its trial or plan ended), else feature_not_in_plan (feature: client_access) on a plan without client access — every paid tier and Strategic include it; a trial does not.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Responses
Section titled “Responses”One person with access to a card, as the coach sees it
(ClientAccessRecord).
object
The address the invite went to.
The person’s name once they accepted; empty until then.
invited · active · expired · revoked. expired is an invite whose 14-day link lapsed; the coach can resend it.
invited- Invitedactive- Activeexpired- Expiredrevoked- Revoked
The invite’s language. Later e-mails to this person use it too.
en- Englishru- Русскийes- Español
Who sent the invite, for the team’s coaches: the inviting coach’s name, else their e-mail address; once their account is gone, the name it left, else “A coach” in ?lang (English by default).
When the invite link lapses — set only while the status is invited.
When the last invite or sign-in e-mail left; null when none ever did.
Whether the e-mail reached the person (false: the transport refused it — the grant stands, resend it). On an invite or resend answer: this call’s e-mail, null when the call sent nothing on purpose (a second resend within a minute). On every other answer: the latest attempt’s, null when none was ever made.
Examples
{ "id": "6f1c2a7e-0d4b-4e8a-9c3f-2b5d7e9a1c40", "email": "anna@example.com", "display_name": "", "relation": "athlete", "level": "view", "status": "invited", "language": "en", "invited_by_name": "Kim Larsen", "invited_at": "2026-10-06T09:00:00Z", "expires_at": "2026-10-20T09:00:00Z", "accepted_at": null, "revoked_at": null, "last_sent_at": "2026-10-06T09:00:00Z", "email_sent": true}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
400 — athlete invite on a minor's card
Minors never hold an account: invite a parent or guardian instead.
{ "detail": "minor_athlete_invite"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Example generated
{ "detail": "example"}The team is read-only, or its plan does not include client access.
object
One of eight canonical strings. The front-end paywall switches copy + CTA on this value (exact string equality — do not localise). quota_exhausted / seat_limit_reached / client_limit_reached / feature_not_in_plan lead to an upgrade CTA; subscription_suspended leads to a Billing Portal CTA so the buyer can update their payment method; exercise_not_in_plan leads to a contact-us CTA — the movement list is sales-managed, no tier adds to it (#2030). trial_expired / access_ended mean the team is read-only (#2901): everything opens, nothing new is created; they lead to a subscribe CTA and always carry reset_at: null.
quota_exhausted- Session quota for the period reached 0subscription_suspended- Stripe dunning in flight (past_due / unpaid)seat_limit_reached- Adding another team member would exceed plan.max_seatsclient_limit_reached- Adding another Client would exceed plan.max_client_profilesfeature_not_in_plan- The tier does not include this whole feature surfaceexercise_not_in_plan- The (activity, exercise) is not in the team’s exercise grantstrial_expired- The team is read-only: its self-serve trial endedaccess_ended- The team is read-only: its paid plan or granted access ended
ISO-8601 UTC timestamp the team’s current period ends. Null when the team has no live subscription (legacy un-migrated row). On Free + paid this is the renewal moment; quota refreshes to exactly plan.session_quota (NOT additive — leftover sessions don’t roll over).
The active plan’s role string (free, starter, professional, organization, strategic). Same value as current_role — kept as two separate fields for forward-compatibility with a future named-plan split where current_plan could carry an SKU and current_role the tier label.
The active plan’s role string. See current_plan.
Which feature surface is locked. Present ONLY on feature_not_in_plan, so one modal can name what’s gated without a detail string per feature (#773). The only value today is agents (aikynetix/agents/services.py::AGENTS_FEATURE).
Examples
A Free team opens the App access panel
{ "detail": "feature_not_in_plan", "reset_at": null, "current_plan": "free", "current_role": "free", "feature": "client_access"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
403 — a client's own account
The coach side is for a coach of the team; a client uses the portal.
{ "detail": "client_account"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
404 — no such grant on the card
{ "detail": "access_not_found"}object
409 — the request conflicts with current state. detail is a stable code (e.g. reanalyze_in_flight, already_on_plan, email_in_use). Some 409s carry extra context fields alongside detail; those are documented on the specific endpoint that emits them.
Examples
409 — the invite was already accepted
An accepted grant has no invite left to resend.
{ "detail": "access_active"}409 — the account's address changed
A sign-in link goes to the account’s own address, which is no longer the invited one: invite the new address instead.
{ "detail": "email_changed"}409 — the grant was revoked
Send a new invite instead.
{ "detail": "access_revoked"}object
429 — throttled: this account’s (or address’s) rate for the route is used up; try again after wait seconds, which Retry-After repeats. A route with a limit of its own answers its own code instead, documented there.
With throttled: whole seconds until the next request can pass.
Example generated
{ "detail": "example", "wait": 1}