> ## Documentation Index > Fetch the complete documentation index at: https://docs.zode.dev/llms.txt > Use this file to discover all available pages before exploring further. # Invite someone > Invite an email address (owner, admin). Mails ` invited you to on Zode` with a link `https://console.zode.dev/invite?token=`. The token (32 random bytes, base64url) is single use, valid 7 days, stored as SHA-256 only and never returned or audited. No member row exists until it is accepted. Admins cannot invite as admin (403). Errors: 400 `invalid_email`, `invalid_request` (role), `personal_workspace`; 409 `already_member`, `invite_pending` (resend it instead); 429 `rate_limited` (30 invite mails per workspace per hour, resends included); 503 `email_unavailable`. Audited as `invite.create`. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/invites openapi: 3.1.0 info: title: Zode API version: 0.1.0 description: Sandboxes for coding agents. Every route takes an API key as a bearer token. servers: - url: https://api.zode.dev security: - bearerAuth: [] tags: - name: Sandboxes - name: Commands - name: Browser and desktop - name: Snapshots - name: Images - name: Environments - name: Flight recorder - name: Attestation - name: Agents - name: Proxying - name: Webhooks - name: OpenTelemetry - name: Alerts - name: CI - name: Usage and billing - name: Workspace - name: Platform paths: /v1/invites: post: tags: - Workspace summary: Invite someone description: |- Invite an email address (owner, admin). Mails ` invited you to on Zode` with a link `https://console.zode.dev/invite?token=`. The token (32 random bytes, base64url) is single use, valid 7 days, stored as SHA-256 only and never returned or audited. No member row exists until it is accepted. Admins cannot invite as admin (403). Errors: 400 `invalid_email`, `invalid_request` (role), `personal_workspace`; 409 `already_member`, `invite_pending` (resend it instead); 429 `rate_limited` (30 invite mails per workspace per hour, resends included); 503 `email_unavailable`. Audited as `invite.create`. operationId: createInvite requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - email - role properties: email: type: string description: Lowercased and trimmed. role: type: string enum: - admin - billing - member responses: '201': description: Invited content: application/json: schema: $ref: '#/components/schemas/Invite' '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '409': $ref: '#/components/responses/Error' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/Error' components: schemas: Invite: type: object required: - id - email - role - invited_by - created_at - expires_at properties: id: type: string pattern: ^inv_[a-z2-7]{16}$ email: type: string role: type: string enum: - admin - billing - member invited_by: type: string description: Inviter's email. created_at: type: string format: date-time expires_at: type: string format: date-time Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string examples: - not_found - rate_limited - plan_required description: | Stable machine code; branch on it rather than on `message`. Deliberately not a closed enum: new codes are added over time, so treat an unknown code by its HTTP status. The codes in use, by status (a few appear under two): - 400: `bad_request` (malformed JSON or unknown field), `invalid_request`, `bad_signature`, `confirm_required`, `default_environment`, `email_not_allowed`, `endpoint_required`, `invalid_code`, `invalid_email`, `invalid_image`, `invalid_name`, `invalid_nonce`, `invalid_state`, `invalid_token`, `not_admin`, `order_mismatch`, `org_required`, `owner_cannot_leave`, `password_too_long`, `password_too_short`, `personal_workspace`, `same_email`, `secret_unsupported`, `self`, `too_many`, `unknown_channel`, `unknown_environment`, `unknown_installation`, `url_not_allowed`, `use_transfer` - 401: `unauthorized`, `invalid_credentials`, `bad_signature` - 402: `plan_required` (the plan does not include it), `credit_exhausted` (no credit left and no card on file) - 403: `forbidden` (the role may not), `token_scope`, `csrf`, `cors`, `email_unverified`, `installation_not_yours`, `no_user`, `not_yours`, `subscriptions_off`, `wrong_account`, `wrong_password` - 404: `not_found`, `code_not_found`, `invalid_invite`, `not_configured`, `unknown_node`, `unknown_org`, `unknown_sandbox` - 409: `invalid_state` (wrong sandbox status), `concurrency_limit` (plan's running-sandbox cap), `daily_cap_reached` (workspace daily spend cap), `limit_reached`, `name_taken`, `node_full`, `not_running`, `browser_off`, `desktop_off`, `already_deleted`, `already_linked`, `already_member`, `already_on_plan`, `billing_not_open`, `checkout_required`, `code_not_applicable`, `code_redeemed`, `code_taken`, `endpoint_disabled`, `installation_taken`, `invite_pending`, `last_method`, `no_sandbox`, `not_placed`, `not_waiting`, `sandboxes_running`, `sole_owner`, `too_many_keys`, `trial_unavailable`, `trial_used` - 410: `expired`, `used`, `expired_token`, `expired_invite`, `code_expired`, `code_used_up` - 413: `too_large` - 415: `unsupported_media_type` - 429: `rate_limited` (see the RateLimited response), `too_many_viewers` (desktop viewers) - 500: `internal` - 501 (this server or host cannot do it yet): `feature_unavailable`, `attach_unavailable`, `exec_unavailable`, `snapshots_unavailable`, `images_unavailable`, `recorder_unavailable`, `attestation_unavailable` - 502: `node_error`, `host_unreachable`, `key_destroy_failed`, `provider_error`, `github_error`, `recorder_error` - 503: `no_capacity`, `unhealthy`, `alerts_unavailable`, `auth_unavailable`, `ci_unavailable`, `email_unavailable`, `ingest_unavailable`, `secrets_unavailable`, `webhook_not_ready` The device-flow code and token endpoints answer 400 in the RFC 6749/8628 shape instead (OAuthError). message: type: string responses: Error: description: Error content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: | `rate_limited`. Limits are fixed windows per caller, workspace or client IP; the headers describe the window that refused the request. headers: Retry-After: description: Seconds until the window resets. schema: type: integer X-RateLimit-Limit: description: Requests the window allows. schema: type: integer X-RateLimit-Remaining: description: Requests left in the window; always 0 on a 429. schema: type: integer X-RateLimit-Reset: description: When the window resets, in Unix seconds (now plus Retry-After). schema: type: integer format: int64 content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: zode_tok_<64 hex chars> description: >- An API key (`zode_tok_...`). Create one in the console under API keys (https://console.zode.dev/tokens), or with `zode login`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.