List outstanding invites for the org
OWNER-only — invite lifecycle is governance. Past-TTL rows are filtered out lazily and flipped to `EXPIRED` in the background.
/api/organizations/{orgId}/invitesOWNER-only — invite lifecycle is governance. Past-TTL rows are filtered out lazily and flipped to EXPIRED in the background.
Path Parameters
Organisation id (cuid)
Response Body
application/json
curl -X GET "https://loading/api/organizations/string/invites"[
{
"id": "inv_k4l5m6n7",
"email": "teammate@your-company.com",
"role": "ADMIN",
"expiresAt": "2026-04-29T10:30:00.000Z",
"createdAt": "2026-04-26T10:30:00.000Z",
"invitedBy": {
"name": "Sam Owner",
"email": "sam@your-company.com"
}
},
{
"id": "inv_o8p9q0r1",
"email": "intern@your-company.com",
"role": "VIEWER",
"expiresAt": "2026-04-28T15:12:00.000Z",
"createdAt": "2026-04-25T15:12:00.000Z",
"invitedBy": {
"name": "Sam Owner",
"email": "sam@your-company.com"
}
}
]Remove a member or self-leave DELETE
Two shapes — self-leave (any role, including last OWNER which triggers ownership transfer to the next-oldest ADMIN) or remove-other (OWNER-only). Personal Space leave is rejected. Sole-member leave is rejected — the route surface answer is to delete the org instead.
Send (or refresh) an invite POST
OWNER-only. Idempotent refresh-or-create: an existing PENDING invite to the same email is updated in place (TTL reset, role swapped, email re-fired). Email send is fire-and-forget — the invite row exists regardless of SMTP outcome. Per-sender rate-limit (`INVITE_DAILY_LIMIT = 100/day`) returns `429` when capped.