> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# Invite someone to a team

> OWNER or ADMIN only. Emails a single-use link (32 random bytes, stored only as SHA-256) valid for 7 days. Re-inviting the
same address replaces the old invite and token. 409 when inviting yourself, someone already in the team, past 50
pending invites, or racing another invite for the same address. Writes a TEAM_INVITE_SENT audit entry.



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/user/teams/{id}/invites
openapi: 3.1.0
info:
  title: Server.Express API
  version: 1.0.0
  description: >-
    The customer-facing Server.Express API: auth, billing, tickets, cloud and
    dedicated servers, hosting, reselling and account management. Every response
    uses the `{ success, data | error }` envelope.
  contact:
    name: Server.Express
    url: https://server.express
servers:
  - url: https://my.server.express/api
    description: Production
security:
  - bearerAuth: []
  - apiToken: []
tags:
  - name: API Tokens
  - name: Account
  - name: Auth
  - name: Cloud
  - name: Coupons
  - name: Credits
  - name: Dashboard
  - name: Dedicated
  - name: Health
  - name: Hosting
  - name: Integrations
  - name: Invoices
  - name: Livechat
  - name: Notifications
  - name: Passkeys
  - name: Payments
  - name: Products
  - name: Public
  - name: Public Invoices
  - name: Public Tools
  - name: Reseller
  - name: SSH Keys
  - name: Services
  - name: Tasks
  - name: Teams
  - name: Tickets
  - name: Web Hosting
  - name: Webhooks
paths:
  /v1/user/teams/{id}/invites:
    post:
      tags:
        - Teams
      summary: Invite someone to a team
      description: >-
        OWNER or ADMIN only. Emails a single-use link (32 random bytes, stored
        only as SHA-256) valid for 7 days. Re-inviting the

        same address replaces the old invite and token. 409 when inviting
        yourself, someone already in the team, past 50

        pending invites, or racing another invite for the same address. Writes a
        TEAM_INVITE_SENT audit entry.
      operationId: publicUserInviteToTeam
      parameters:
        - name: id
          in: path
          required: true
          description: Team id.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PublicUserInviteRequest'
      responses:
        '201':
          description: Invite sent.
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                properties:
                  success:
                    type: boolean
                    const: true
                  data:
                    $ref: '#/components/schemas/PublicUserNewInvite'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
        - bearerAuth: []
components:
  schemas:
    PublicUserInviteRequest:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
          maxLength: 190
          description: Trimmed and lowercased.
        role:
          type: string
          enum:
            - ADMIN
            - OPERATOR
            - VIEWER
          default: VIEWER
    PublicUserNewInvite:
      type: object
      required:
        - id
        - email
        - role
        - expired
        - expiresAt
      properties:
        id:
          type: string
        email:
          type: string
          format: email
        role:
          type: string
          enum:
            - ADMIN
            - OPERATOR
            - VIEWER
        expired:
          type: boolean
          const: false
        expiresAt:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
      additionalProperties: true
  responses:
    BadRequest:
      description: Validation failed or the request is malformed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, invalid or expired credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: >-
        Authenticated but not allowed (missing scope, not an admin, or not your
        resource).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The resource doesn't exist or isn't visible to you.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: The request conflicts with the resource's current state.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh.
        A session satisfies every API scope.
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: se_live_<prefix>_<secret>
      description: >-
        Personal API token created under Settings → API tokens. Only routes
        guarded by verifyApiAuth accept it, and the token must carry the scope
        named in the operation's x-required-scope.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.