Docs / API and agents
Invitations API
Customers invite their suppliers, suppliers invite customers, and an invited business accepts.
| Method and path | Who | What |
|---|---|---|
POST /customer/supplier-invitations (alias POST /customer/vendor-invite) | customer with invitations.supplier in an active organization | invite a supplier. Send Idempotency-Key; a replay answers 200, a new invitation 201 { ok, queued, invitation } |
GET /customer/supplier-invitations?limit=&cursor= | same | list own invitations (limit 1-50) |
GET /customer/supplier-invitations/:token/context | public; a session adds who is signed in | what the invitation page shows; 410 if invalid or expired |
POST /customer/supplier-invitations/:token/accept | session | accept for your own business; body must carry confirmed: true |
POST /invite-customer | supplier with the sending permission, approved organization with a published application | queue a customer invitation |
Rules#
- The sender's membership is re-checked inside the transaction: the user is active with a verified email and the organization is active and not denied or suspended (403). Suppliers must be approved with a published application (409 otherwise).
- The recipient must have a deliverable email (400). Limits: 10 invitations per sender and 3 per recipient per hour (429); accept is limited to 20 per minute.
- The invitation is committed with its outbox email and audited (
supplier.invitation_queued,customer.invitation_queued,supplier.invitation_accepted). - Accepting never joins an existing organization on name or email match alone; it needs the token and an explicit confirmation.