---
title: "Accept an invite — atomically link the member row"
description: The atomic claim.
api_method: POST
api_path: "/v1/invites/accept"
canonical_url: https://wiblo.app/docs/developers/api/invites/accept-invite
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/invites/accept-invite.md
---

# Accept an invite — atomically link the member row

`POST /v1/invites/accept`

The atomic claim. Requires a signed-in human (session, Supabase JWT bearer, or CLI token; machine bearers are rejected — a machine cannot become a workspace member). One transaction in the RPC: invite locked, member locked, `linked_user_id`+`linked_at` written, invite consumed. Re-accepting with the same account is idempotent (`already_accepted: true`, e.g. page refresh); a different account gets `INVITE_ALREADY_USED`. Body-based POST for the same log-hygiene reason as resolve. Per-user rate-limited at 10/60s.

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `invite_token` | `string` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/invites/accept \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "invite_token": "..."
}'
```

**TypeScript**

```ts
import { createSdk, acceptInvite } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await acceptInvite({
  client: sdk,
  body: {
    "invite_token": "..."
  },
})
```

## Responses

**`200`** — Linked (or idempotently confirmed). Carries the workspace slug for the post-accept redirect. Returns `AcceptInviteResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | `string` | Yes |  |
| `workspace_slug` | `string` | Yes |  |
| `workspace_name` | `string` | Yes |  |
| `member_id` | `string` | Yes |  |
| `member_name` | `string` | Yes |  |
| `member_role` | `"owner" \| "admin" \| "member"` | Yes |  |
| `already_accepted` | `boolean` | Yes |  |

**`400`** — Request body failed Zod validation (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid session or user bearer was present. Returns `ApiErrorEnvelope`.

**`403`** — A machine bearer cannot satisfy a user-scoped route (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — Unknown, revoked, or dead-context token (`INVITE_NOT_FOUND`). Strangers holding a dead link learn nothing. Returns `ApiErrorEnvelope`.

**`409`** — Consumed by a different account (`INVITE_ALREADY_USED`), the member linked out-of-band to someone else (`MEMBER_ALREADY_LINKED`), or the acceptor is already linked to another member row here (`ALREADY_MEMBER`). Returns `ApiErrorEnvelope`.

**`410`** — Past `expires_at` (`INVITE_EXPIRED`) — ask for a new link. Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.