API reference · Auth
Preview invitation
What the acceptance page may show before anybody has signed in.
- Authentication
- None
- Retries
- Safe to repeat
- Body
- None
- Version
- 2026-09-03
A GET with the token in the query string, because the recipient arrives by clicking a link. That does put the token in browser history and in any referrer the page leaks - which is why it is single-use, expires in seven days, and why the page should exchange it for a session promptly.
Query parameters
tokenstringrequired
Responses
- 200OKapplication/json
InvitationPreview
emailstringrequiredexpires_atstring (date-time)requiredorganization_namestringrequiredorganization_slugstringrequiredroleOrgRole | stringrequiredhas_accountbooleanDefault: false
invited_bystring | null
5 response headers
- RateLimit-Limit
Requests permitted in the current window.
- RateLimit-Remaining
Requests left in the current window. Back off before it reaches 0.
- RateLimit-Reset
Seconds until the current window resets.
- X-API-Version
The dated version of the API contract that served this response, e.g.
2026-09-03. Pin against it; it changes only when a response shape changes incompatibly.- X-Request-ID
Quote this in a support request to identify the call.
- 422Validation error
The shared error envelope, served as
application/problem+jsonwitherror.codeset to validation_error. Its details name each field that failed and why.
Example request
curl "https://api.integrable.cloud/api/auth/invitation?token=string"Set INTEGRABLE_API_KEY first. The same call from the TypeScript or Python SDK takes the same fields.
Example response
{
"email": "sam@example.com",
"expires_at": "2026-09-03T09:30:00Z",
"has_account": false,
"invited_by": "string",
"organization_name": "string",
"organization_slug": "string",
"role": "owner"
}Generated from the schema above — the shape is exact, the values are placeholders.
Errors
Failures use one envelope on every endpoint, described in Retries, versioning and limits. The codes you are most likely to meet here:
validation_error· 422 — The payload was well-formed JSON but failed schema validation.rate_limited· 429 — Too many requests in the current window. The limit is per workspace, and some endpoints add a per-bot limit on top.
More Auth endpoints
- post/api/auth/accept-invitationAccept invitation
- post/api/auth/change-passwordChange password
- post/api/auth/forgot-passwordForgot password
- post/api/auth/googleComplete Google sign-in
- get/api/auth/google/startStart Google sign-in
- get/api/auth/identitiesList identities
- delete/api/auth/identities/{provider}Unlink identity
- post/api/auth/loginLog in
- post/api/auth/logoutLog out
- post/api/auth/logout-allLog out everywhere
- get/api/auth/meGet the current user
- get/api/auth/mfaMFA status
- post/api/auth/mfa/activateActivate MFA
- post/api/auth/mfa/disableDisable MFA
- post/api/auth/mfa/recovery-codesRegenerate recovery codes
- post/api/auth/mfa/setupSetup MFA
- post/api/auth/mfa/verifyVerify MFA
- get/api/auth/organizationsList my organizations
- post/api/auth/otp/requestRequest OTP
- post/api/auth/otp/verifyVerify OTP
- post/api/auth/refreshRefresh a session
- post/api/auth/registerRegister an account
- post/api/auth/resend-verificationResend verification
- post/api/auth/reset-passwordReset password
- get/api/auth/verification-statusVerification status
- post/api/auth/verify-emailVerify email
Something here wrong or missing? Tell us — the documentation and the API are maintained by the same person, so a correction is a fix rather than a ticket.