Invite links API
Use these routes to invite someone without entering their email. A user with permission generates a single-use link that expires in 24 hours; the person who receives it reads the organization and role and creates an account tied only to that organization. For the Console walkthrough, see Invite members.
Authentication and authorization
The management routes (generate, list, and revoke) require a valid user session and the member.invite permission on organization:*. API keys are not accepted. Send the active organization in the x-organization-id header, with the same value as the route :id.
Authorization: Bearer <user-token>
x-organization-id: <organization-id>
Content-Type: application/jsonThe owner has full access. An assistant with member.invite can only generate links for the member role and can only grant permissions and policies they hold themselves; trying to grant more returns 403.
The routes that read and accept a link are public: the link token itself is the credential.
Base URL and routes
https://api.zenifra.com/v1| Goal | Method and route | Authentication |
|---|---|---|
| Generate a link | POST /organizations/:id/invite-links | User session with member.invite |
| List active links | GET /organizations/:id/invite-links | User session with member.invite |
| Revoke a link | DELETE /organizations/:id/invite-links/:linkId | User session with member.invite |
| Read a link | GET /organizations/invite-links/:token | Public |
| Accept a link and create the account | POST /organizations/invite-links/:token/accept | Public |
Generate a link
POST /v1/organizations/:id/invite-links| Field | Type | Required | Description |
|---|---|---|---|
role | string | Yes | member or assistant |
permissions | object | No | Direct permissions, in the same format as the email invitation |
policy_ids | array of strings | No | IDs of reusable organization policies |
{
"role": "member",
"policy_ids": ["<policy-id>"]
}201 response:
{
"status": "success",
"message": "organization invite link created with success",
"data": {
"id": "<link-id>",
"token": "<token>",
"role": "member",
"policy_ids": ["<policy-id>"],
"expires_at": "2026-10-27T12:00:00.000Z",
"created_at": "2026-10-26T12:00:00.000Z"
}
}The link to share is https://console.zenifra.com/invite/<token>. The token appears only in this response: store it or share it right away. After that, you can only list or revoke the link.
Errors: 400 for invalid data, 403 for insufficient permission (including trying to grant more than you have), and 404 when a policy is not found. Limit: 10 requests per minute.
List active links
GET /v1/organizations/:id/invite-linksReturns links that have not been used, revoked, or expired, newest first. The token is not returned.
{
"status": "success",
"message": "get organization invite links with success",
"data": [
{
"id": "<link-id>",
"role": "member",
"policy_ids": ["<policy-id>"],
"expires_at": "2026-10-27T12:00:00.000Z",
"created_at": "2026-10-26T12:00:00.000Z"
}
]
}Limit: 30 requests per minute.
Revoke a link
DELETE /v1/organizations/:id/invite-links/:linkIdReturns 200 with status: "success". Once revoked, the link responds as unavailable. If the link does not exist, was already used, or has expired, the response is 404 with the message invite link not found. Limit: 10 requests per minute.
Read a link
GET /v1/organizations/invite-links/:tokenPublic route. Returns the organization name and the role, to show before sign-up.
{
"status": "success",
"message": "get organization invite link with success",
"data": {
"organization": { "name": "My company" },
"role": "member",
"expires_at": "2026-10-27T12:00:00.000Z"
}
}Used, revoked, or expired links respond 404 with the message invite link not found. Limit: 30 requests per minute.
Accept a link and create the account
POST /v1/organizations/invite-links/:token/acceptPublic route. Creates an account that belongs only to the link's organization, asking only for basic data.
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Person's name |
email | string | Yes | Account email |
password | string | Yes | Account password |
accepted_terms | boolean | Yes | Must be true |
accepted_age | boolean | Yes | Declaration of legal age; must be true |
preferred_locale | string | No | pt-BR or en-US |
{
"name": "Maria Silva",
"email": "[email protected]",
"password": "<password>",
"accepted_terms": true,
"accepted_age": true,
"preferred_locale": "en-US"
}CPF/CNPJ, phone number, date of birth, and address are not required. The 201 response has the same format as the regular sign-up: a session token and a challenge_token, used to confirm the email with the code that was sent.
{
"status": "success",
"message": "create user with success",
"data": {
"token": "<session-token>",
"challenge_token": "<challenge-token>"
}
}The account created:
- has access only to the link's organization, with the role, policies, and permissions defined when the link was generated;
- does not get its own organization or sign-up credit;
- does not receive invitations from other organizations or email-domain join suggestions;
- loses access if removed from the organization.
The link is consumed on acceptance and cannot be reused.
Errors: 400 for invalid data, 404 when the link is unavailable (invite link not found), and 409 with user already exists when the email already has a Zenifra account; in that case, send an email invitation. Limit: 5 account creations per minute.
Last updated on