Invite User
POST/api/users/store-user
Creates a new user and sends them an email invitation to set their own password (in production). In non-production environments, a password is generated and returned in the response.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Authentication: Requires Bearer token.
Fields:
- email (required, valid email, max:255, must be available) — User's email address
- name (required, string, max:255) — User's full name
- is_admin (optional, boolean, default: false) — Grant admin privileges
- is_power_user (optional, boolean, default: false) — Grant power user privileges
Email availability:
- Address held by an active user, in this tenant or any other — rejected (422).
- Address held by a deactivated user who is still a member of this tenant — rejected (422) with a message pointing at reactivation; reactivate them with
DELETE /api/users/{user}instead of inviting again. - Address held by a deactivated user who belongs to no tenant at all — accepted. The dormant account is reclaimed in place under the new name, its credentials, sessions and roles are cleared, and it is attached to the current tenant. The user id is preserved, so historical records still resolve.
Requires permission: users.create
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.