# Renew a person's invitation POST /v1/identity/users/{userId}/invite ```sh curl --request POST \ --url https://example.com/v1/identity/users/example/invite \ --header 'Authorization: Bearer ' ``` For a person who hasn’t signed in yet (`invite` pending or expired): a new expiry, 7 days on, and the invitation emailed again where the deployment sends email (`inviteEmail` says whether it was). A person who has signed in, was added before invitations, or has no email gets `409 identity-user-not-invited`. Renewing one person again within a minute, more than 5 times in 24 hours, or past the invitation emails the workspace, or the whole deployment, may send in 24 hours, gets `429 invite-capped` with `Retry-After`, and changes nothing. To revoke an invitation, remove the person (`POST /v1/identity/users/{userId}/unregister`). Tenant admins only. Mounted when the identity directory invites people (from 0.1.9). ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.9/reference/api.md#bearerauth)** ## Parameters ### Path Parameters **userId** required string \>= 1 characters ### Header Parameters **Idempotency-Key** string \>= 1 characters Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per `docs/API-ROUTE-CONVENTIONS.md` §3.1). A retry sent while the first request still runs is answered `409 idempotency-key-in-flight` with `Retry-After`, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets `409 idempotency-key-replay-withheld`, with the first request’s status and when it succeeded (from 0.1.5). ## Responses ### 200 The person, with the new expiry, and whether the invitation was emailed. application/json The person, with their invitation’s new expiry, and whether it was emailed. object **user** required Tenant-scoped user record (admin plane). `primaryEmail` may be redacted on the wire based on tenant policy (the routes treat it as opaque). `metadata` is free-form JSON — deployments carry IdP claims / provisioning source / roles here. object **userId** required string **tenantId** required string format: uuid **primaryEmail** string **displayName** string **createdAt** required string format: date-time **lastActiveAt** string format: date-time **unregisteredAt** When they were removed from the tenant (`POST /v1/identity/users/{userId}/unregister`); absent while they are here. string format: date-time **invite** Their invitation, while they haven’t signed in: absent once they have, for people added without an email, and for people added before invitations (from 0.1.9). object **state** required string Allowed values: pending expired **expiresAt** required string format: date-time **sentAt** When it was last emailed; absent when it never was. string format: date-time **firstSignedInAt** Their first sign-in that made a session. Absent before it, and for people who last signed in before it was kept (from 0.1.9). string format: date-time **metadata** object **_key_** additional properties any **grants** The person’s grants: only on `GET /v1/identity/users?include=grants`, and only from a runtime that reads grants. object **userId** required string **tenantAdmin** Whether the person is a tenant admin. Absent when the runtime has no authorization store: nothing grants it then. boolean **tenantMember** Whether the person is a tenant member: they read the tenant’s settings (providers, policies, adapters, signing keys, deployments), not its projects. A person is one from being added. Absent when the runtime has no authorization store, or doesn’t report it. boolean **projects** required Direct project memberships. Array\