(Re)send internal user invitation

POST/internal-users/{userId}/invite

internal-users:write invite_internal_userDeprecatedSunset 2027-06-30

Issues or re-issues the standard invitation email for an existing user. A user who has already completed registration returns 422 (user_already_registered).

Deprecated: withdrawn on 2027-06-30. POST /internal-users/{id}/actions/send-invite replaces it; every answer carries a Link header with rel="successor-version". This route keeps its old body and answer. A user who completed registration still returns 422 user_already_registered here, where the action returns 409. A new invite uses the internal invitation template. The invite owner is the token's user, if any.

Path parameters

userIdstring (uuid)Required#
The user's public guid.

Responses

200

Invitation sent

{
  "invited": true,
  "invite_id": "3c4d5e6f-7081-4920-a1b2-c3d4e5f60718",
  "status": "pending",
  "expires_at": "2026-06-22T10:30:00+00:00"
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

404

Resource not found (error.code = not_found).

Error

422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/internal-users/{userId}/invite\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"