Fetch invite preview (public, token-only)

GET

/api/invites/{token}/

const url = 'http://localhost:8000/api/invites/example/';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:8000/api/invites/example/ \
  --header 'Authorization: Bearer <token>'

Public endpoint — token in the URL is the only auth. Used by the invite-accept landing page to render team name, inviter, expiration date, and status before the recipient signs in. Stale-but-not-yet-swept invites are reflected as expired in the response so the UI shows the right empty state. Returns 404 for unknown tokens. Don’t include any field here that wouldn’t be safe to show to anyone holding the link (same audience as the email recipient).

Auth: none — the token in the path is the credential.

Authorizations

Parameters

Path Parameters

token

required

string

Responses

200

application/json

Public (token-authenticated) preview shown on the accept page.

object

email

required

Email the invite was sent to. Shown so the recipient can confirm it landed in the right inbox.

string format: email

display_name

required

Friendly name supplied at invite creation (optional). Used by the SPA to prefill the signup form so the invitee doesn’t retype it.

string

team_name

required

Display name of the team the recipient is being invited to.

string

inviter_name

required

Display name of the coach who sent the invite.

string

inviter_email

required

Email of the coach who sent the invite.

string format: email

expires_at

required

When this invite stops working.

string format: date-time

status

required

Effective status: pending / accepted / cancelled / expired. May be expired even if the DB still says pending — preview reflects the time-checked status.

string

Examples

InvitePreview

Invite preview

{
  "email": "newcoach@club.example",
  "display_name": "New Coach",
  "team_name": "Riverside Track Club",
  "inviter_name": "Head Coach",
  "inviter_email": "coach@club.example",
  "expires_at": "2026-06-10T00:00:00Z",
  "status": "pending"
}

404

application/json

object

detail

required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Examples

404—UnknownInviteToken

404 — Unknown invite token

{
  "detail": "invite_not_found"
}