Skip to content
StraventaDocs
Now in Sandbox.

List pending invitations in the caller's tenant

GET
/v1/admin/invitations

Returns UNACCEPTED invitations (accepted_at IS NULL) for the caller's tenant in the standard paginated envelope. status is derived per row — revoked when the invitation was revoked, else pending while expires_at is in the future, else expired. Accepted invitations are excluded: the invited user appears in GET /v1/admin/users after acceptance. Supports free-text search on email. Requires tenant.users.read.

By DEFAULT revoked invitations are excluded entirely, which is the long-standing behaviour of this endpoint and is preserved deliberately — returning them unasked would change what an already-shipped paginated list contains. Pass include_revoked=true to have them returned and labelled revoked; revoked_at carries the revocation timestamp and is null on every other row.

Authorization

bearerAuth
AuthorizationBearer <token>

JWT Bearer access token. Clock skew tolerance is ±60 seconds.

In: header

Query Parameters

page?integer
Default1
Range1 <= value
limit?integer
Default20
Range1 <= value <= 100
search?string
sort?string

Column to order pending invitations by. Defaults to created_at descending. status and delivery_state are computed per row after the page is sliced and are not sortable — order by expires_at instead, which is what status is derived from. Anything else returns 400 invalid_sort_key.

Value in"email" | "created_at" | "expires_at"
order?string

Sort direction. Ignored unless sort is supplied; an unrecognised value returns 400 invalid_sort_order.

Value in"asc" | "desc"
include_revoked?boolean

Include revoked invitations in the result, labelled with status revoked. Omitted or any value other than true / 1 keeps the default shape, in which revoked invitations are absent. Revocation outranks expiry — a revoked invitation whose expires_at has since passed is still reported as revoked, because it was cancelled rather than left to lapse.

Defaultfalse

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X GET https://sandbox.505pay.link/v1/admin/invitations \  -H "Authorization: Bearer $TOKEN" \  -H "Content-Type: application/json"
{
  "invitations": [
    {
      "id": "018f6d0e-1111-7abc-8def-111111111111",
      "email": "[email protected]",
      "role_ids": [
        "11111111-1111-1111-1111-111111111111"
      ],
      "group_ids": [],
      "invited_by": "22222222-2222-2222-2222-222222222222",
      "created_at": "2026-07-08T04:10:00Z",
      "expires_at": "2026-07-11T04:10:00Z",
      "status": "pending"
    }
  ],
  "total": 1,
  "page": 1,
  "limit": 20,
  "total_pages": 1
}
{
  "error": "invalid_sort_key",
  "message": "unsupported sort key",
  "request_id": "req_01abc134"
}
{
  "error": "unauthenticated",
  "message": "missing or invalid bearer token",
  "request_id": "req_01abc123"
}
{
  "error": "permission_denied",
  "message": "caller does not hold the required permission",
  "request_id": "req_01abc124"
}
{
  "error": "rate_limited",
  "message": "too many requests",
  "request_id": "req_01abc127"
}

Was this page helpful?