Invitations

Accept the invitation an emailed dtni_ token refers to, seating the caller in the organization with the invitation's roles (an already-seated caller keeps their roles; the invitation is consumed either way). Possession of the token is the authorization; no organization permission is checked because the caller is not yet seated, and the caller's address is not compared with the invited one — the audit record carries both. Only an OIDC user JWT is admitted; dtno_ organization API keys are not.

Decline the invitation an emailed dtni_ token refers to. Possession of the token is the authorization; no organization permission is checked because the caller is not yet seated. The row stays visible to the organization as declined until it is revoked or the address is re-invited. Only an OIDC user JWT is admitted; dtno_ organization API keys are not.

Show the invitation an emailed dtni_ token refers to: the organization, the roles it would grant, who sent it, the invited address and the expiry. Possession of the token is the authorization; no organization permission is checked because the caller is not yet seated. A missing, used, declined, expired, or malformed token answers 404. Only an OIDC user JWT is admitted; dtno_ organization API keys are not.

List the undecided invitations of one organization: pending, declined, and expired rows (each carries declined_at and expires_at so a consumer can tell them apart). The caller must be a seated member holding read:members. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Create or re-issue an organization invitation. Mints a single-use dtni_ token and, when the api has an SMTP mailer configured, emails the invitee a link carrying it after the request commits (a re-invite rotates the token and is the resend); without a mailer the response's accept_url carries the link instead. The caller must be a seated member holding write:members; the route also enforces the role-delegation rules for the invited role set. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Revoke an unaccepted organization invitation. The caller must be a seated member holding write:members; the route also enforces the current-side delegation rule for the invited role set. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.