Skip to content
KataraKatara documentation

Review a private organization invitation

POST
/katara/v1/orgs/{org_id}/invitations/{id}/review
curl --request POST \
  --url https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/invitations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/review \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Katara-CSRF: 1' \
  --data '{ "token": "example" }'

Session only. POST the one-use token in JSON; no query parameters are accepted or needed. Only the intended verified, active and unbanned account may read an unused, unrevoked and unexpired invitation: for an email invitation, the signed-in account whose confirmed email address matches it, ignoring case. Any other account gets 403 invitation_address_mismatch once the invitation is otherwise usable. The organization, inviter account and current member-administration authority are checked while locked. Returns only organization name and identifiers, intended user (for an email invitation, the signed-in account), inviter ID, role, expiry, organization and invitation versions, and exact review digest. No token or token hash is returned. Cookie requests require Origin, X-Katara-CSRF and the mounted X-Katara-Account-ID. Response is no-store. Review is read-only and does not require an idempotency key.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Header Parameters

Section titled “Header Parameters”
X-Katara-CSRF
Allowed value: 1

Browser cookie mutations require value 1 and an allowed Origin. Session bearer clients may omit this header.

X-Katara-Account-ID
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Required for cookie-authenticated changes. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
token
required
string
/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/
Examplegenerated
{
  "token": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Successful request

Media typeapplication/json
object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
invitation_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
user_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
invited_by
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
organization_name
required
string
>= 1 characters <= 120 characters
organization_version
required
integer
>= 1 <= 9007199254740991
role
required
Allowed values: admin builder operator reviewer viewer billing
expires_at
required
string format: date-time
version
required
integer
>= 1 <= 9007199254740991
digest
required
string
/^sha256:[a-f0-9]{64}$/
Example
{
  "role": "admin"
}

403

Section titled “403”

Invitation_address_mismatch: the invitation was sent to a different email address; sign in with that address. Otherwise permission_denied: the invitation is unavailable, expired, revoked or used.

409

Section titled “409”

The cookie account differs from the mounted account. Reopen from the current signed-in workspace.

default

Section titled “default”

Request error

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}