Redeem a one-time invite token and set a password

POST

/operator/invite/accept

curl --request POST \
  --url http://localhost:3000/operator/invite/accept \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example", "password": "example" }'

Unauthenticated by nature — this route IS how a token is first obtained. Redemption is single-use: a replayed token, an expired one, or one for a since-disabled operator all fail identically.

Request Body^required

Media typeapplication/json

object

token

required

string

>= 1 characters

password

required

string

>= 12 characters <= 1024 characters

Example^generated

{
  "token": "example",
  "password": "example"
}

Responses

200

A session token and the operator’s public profile.

Media typeapplication/json

object

token

required

Operator session token. Bearer-authenticate with it as operatorToken.

string

expires_at

required

string format: date-time

operator

required

An operator as returned by login, invite acceptance, and GET /operator/me — the same shape everywhere so a dashboard hitting any of the three sees one model. Never carries password_hash.

object

id

required

string

name

required

string

email

required

string format: email

role

required

string

Allowed values: staff owner member

tenant_id

required

Null for platform staff.

string | null

Example

{
  "operator": {
    "role": "staff"
  }
}

400

Malformed body — missing or empty token, or a password shorter than 12 characters or longer than 1024.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

401

Invite token unknown, already used, or expired.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

429

Rate limit exceeded.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

Headers

Retry-After

integer