---
title: Invite a member to link an account
description: Owner/admin mints a single-use claim on one unlinked, active, human member row.
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/members/{memberId}/invites"
canonical_url: https://wiblo.app/docs/developers/api/invites/create-member-invite
last_updated: 2026-08-12T15:34:51+02:00
md_url: https://wiblo.app/docs/developers/api/invites/create-member-invite.md
---

# Invite a member to link an account

`POST /v1/workspaces/{workspaceId}/members/{memberId}/invites`

Owner/admin mints a single-use claim on one unlinked, active, human member row. The raw `wbl_invite_*` token is returned exactly once — copy it or send it; the pending list only ever shows the prefix. Creating a new invite supersedes the member's prior active invite in the same transaction (one live invite per member, structurally). User-backed credentials only: session, Supabase JWT, and CLI tokens (`wbl_user_*` / `wbl_ephem_user_*`) may mint, while machine bearers (`wbl_live_*` / `wbl_ephem_ws_*`) are rejected with 403 before the handler runs — a machine credential must never mint access. Role gating happens inside the RPC against the actor's live role (`INSUFFICIENT_PRIVILEGE` 403 for member-role callers). Workspace-scoped mint budget: 10/10min shared across the workspace's users.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |
| `memberId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `email` | `string \| null` | No |  |
| `expires_in_days` | `integer \| null` | No |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/members/{memberId}/invites \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "...",
  "expires_in_days": 0
}'
```

**TypeScript**

```ts
import { createSdk, createMemberInvite } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await createMemberInvite({
  client: sdk,
  path: { workspaceId: "...", memberId: "..." },
  body: {
    "email": "...",
    "expires_in_days": 0
  },
})
```

## Responses

**`201`** — Invite minted. `invite_token` appears here and nowhere else. Returns `MemberInviteMintResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `invite_token` | `string` | Yes |  |
| `id` | `string` | Yes |  |
| `member_id` | `string` | Yes |  |
| `token_prefix` | `string` | Yes |  |
| `email` | `string \| null` | Yes |  |
| `email_delivery` | `"sent" \| "failed" \| "skipped"` | Yes |  |
| `expires_at` | `string` | Yes |  |
| `created_at` | `string` | Yes |  |

**`400`** — Request body failed Zod validation (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid session cookie or user bearer was present. Returns `ApiErrorEnvelope`.

**`403`** — A machine bearer (`wbl_live_*` / `wbl_ephem_ws_*`) was presented, or the caller's live role is not owner/admin (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — Caller has no active membership in the workspace (`WORKSPACE_NOT_FOUND`), or the target member does not exist here / is a machine row (`MEMBER_NOT_FOUND`). Both collapse cross-tenant existence leaks. Returns `ApiErrorEnvelope`.

**`409`** — Target member already has a linked account (`MEMBER_ALREADY_LINKED`) or is archived (`MEMBER_NOT_INVITABLE`). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`). Body-shape failures — malformed email, out-of-bounds `expires_in_days` — are 400 `VALIDATION_FAILED`: the contract bounds match the DB gates exactly, so the RPC's `INVALID_TTL`/`INVALID_EMAIL` raises are unreachable through this API. Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.