anoman
Sign InGet API Key
Documentation home

Team invitations

Add staff to an organization by email. Every invitation is single-use, email-bound, and expires in 7 days.

Invite staff by email

Admins invite dashboard users with POST /anoman/v1/accounts/{id}/invitations. The role is one of admin (full management), admin_read_only (read-only auditor), or member (staff access per RBAC) — see Organizations for what each role can do.

This flow is for staff who get a dashboard. Non-technical employees who only use Copilot are onboarded as managed endusers instead — a separate, domain-gated invite path.

Invite staff

# Invite a staff member by email (admin+). Roles:
#   admin | admin_read_only | member
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../invitations \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "role": "member" }'
 
# 200 OK — the raw token is emailed to the invitee, never returned here.
# {
#   "id": "inv_71ad...",
#   "email": "[email protected]",
#   "role": "member",
#   "status": "pending",
#   "expiresAt": "2026-08-20T09:00:00Z"
# }

How invitations work

  • Single-use, hashed token — the raw token is emailed to the invitee and never returned by the API; only a salted hash is stored.
  • 7-day expiry — after 7 days the token is dead and an admin must re-send a fresh invitation.
  • Email-bound — the account accepting must match the invited email (case-insensitive); you can't forward an invite to a different address.
  • Verified email required — the invitee's Anoman email must be verified before they can accept.

The accept flow

The invitation email links to /invite/{token} on the dashboard. That page validates the token and shows the org and role, then accepts on one click.

  1. Signed out → the invitee signs in or creates an account, and is round-tripped back to the invite page.
  2. Signed in → the page validates the token and displays the org + role; one click accepts.
  3. On accept, staff are auto-switched into the org; endusers are pointed to Copilot instead.

Validate & accept

# Validate a token (what /invite/{token} calls under the hood).
curl https://api.anoman.io/anoman/v1/invitations/<token>
 
# 200 OK
# { "accountId": "acct_9f2b...", "accountName": "Acme Corp",
#   "role": "member", "email": "[email protected]" }
 
# Accept it (the signed-in invitee, email must match).
curl https://api.anoman.io/anoman/v1/invitations/accept \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "token": "<token>" }'

List and revoke

Admins can see pending and past invitations and revoke any that haven't been accepted yet. In the dashboard this is the Members page → Invitations tab (invite dialog, pending list, revoke button).

List & revoke

# List pending and past invitations (admin+).
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../invitations \
  -H "Authorization: Bearer anm-sk-..."
 
# Revoke a pending invitation.
curl -X DELETE \
  https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../invitations/inv_71ad... \
  -H "Authorization: Bearer anm-sk-..."

Auditors can't see this. The invitations list endpoint is admin-gated, so the Invitations tab is hidden for admin_read_only auditors.

Invite your team

Send an invitation from the Members page — it's live in seconds.

On this page