Members & invitations

Members (direct)

# List
GET    /api/v1/members?workspaceId=ws_…   -H "x-admin-token: $MAVERA_ADMIN_TOKEN"

# Add / update (idempotent by userId)
POST   /api/v1/members   -H "x-admin-token: $MAVERA_ADMIN_TOKEN"
  -d '{ "workspaceId":"ws_…", "userId":"user_42", "email":"sam@acme.com", "role":"ADMIN" }'

# Remove
DELETE /api/v1/members?userId=user_42&workspaceId=ws_…   -H "x-admin-token: $MAVERA_ADMIN_TOKEN"

Roles: OWNER, ADMIN, MEMBER, VIEWER.

Invitations (by email)

Use when you don't yet have the person's userId. Create an invite → email them a link embedding the token → they accept, which creates the member.

Create the invite

POST /api/v1/invitations   -H "x-admin-token: $MAVERA_ADMIN_TOKEN"
  -d '{ "workspaceId":"ws_…", "email":"teammate@acme.com", "role":"MEMBER" }'
# → data: { id, email, role, token:"inv_…", expiresAt, note:"shown once" }

The token is returned once. Email a link like https://your-app/invite?token=inv_…. Invites expire in 7 days.

Invitee accepts

POST /api/v1/invitations/accept

  -d '{ "token":"inv_…", "userId":"user_teammate_1" }'
# → data: { member: { workspaceId, userId, email, role } }

This endpoint is open — the token is the credential. Supply the invitee's resolved userId from your auth layer.

Manage pending invites

GET    /api/v1/invitations?workspaceId=ws_…    # list (status: PENDING|ACCEPTED|REVOKED|EXPIRED)
DELETE /api/v1/invitations?id=<inviteId>       # revoke a pending invite

Invite tokens are stored as SHA-256 hashes (like API keys) and single-use. An expired or already-accepted token returns 422 VALIDATION_ERROR.

Members (direct)

Invitations (by email)

Create the invite

Invitee accepts

Manage pending invites

On this page