Create an invite

POST/invites

Creates an investor or an internal user together with their invite, and returns the invite with a Location. type is investor or internal_user; an advisor invite is not available here. The invite is sent straight away unless send is false, which leaves an investor's invite a draft for POST /invites/{id}/actions/send. An email that a user, a contact or another open invite already holds returns 422 unique; unlike POST /investors this never returns the existing record. An internal user needs title, takes neither send: false nor sso_id, and needs the permission to edit any user, which invites:write alone does not give, else 403 missing_permission. An investor's email goes out after commit and a delivery failure is logged; an internal user's is prepared inside the create and a failure there rolls it back with 500. Never on dry_run. Emits invite.created and investor.created or internal_user.created. It can't be undone, but POST /invites/{id}/actions/revoke withdraws the invite.

Query parameters

dry_runboolean#
Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

Idempotency-Keystring#
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · InviteCreate

typestringRequired#
Who the invite is for: investor or internal_user. An advisor invite is not available here.
One of: investor, internal_user
emailstring (email)Required#
The invitee's email. At most 53 characters, so the sign-in username with its invite suffix fits 64. An email a user, contact or open invite already holds returns 422 unique.
titlestring | null#
The invitee's title, such as Mr, Ms or Dr. Required for an internal user.
first_namestringRequired#
The invitee's first name.
last_namestringRequired#
The invitee's last name.
sso_idstring | null#
The investor's single sign-on id. Not accepted for an internal user.
onboarding_idstring (uuid)#
The published investor journey to follow. Required while one is published (422 required); an unpublished id, or any id while none is published, is 422 exists. Not accepted for an internal user. Fixed after creation.
sendboolean#
true sends the invitation straight away. false leaves an investor's invite a draft, and is not accepted for an internal user.
Default: true

{
  "type": "investor",
  "email": "ada.lovelace@example.com",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "send": true
}

Responses

201

The invite was created.

Invite

{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "type": "investor",
    "status": "invited",
    "email": "string",
    "title": "string",
    "first_name": "string",
    "last_name": "string",
    "sso_id": "string",
    "onboarding_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "user_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "expires_at": "2026-06-12T10:00:00+00:00",
    "invited_at": "2026-06-12T10:00:00+00:00",
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/invites\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "type": "investor",
  "email": "ada.lovelace@example.com",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "send": true
}'