POST Accept a workspace invitation
/api/v1/workspace-invitations/accept
Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.
On this page
Access and permissions
Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.
Browser session: __Host-mb_session cookie.
When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.
Parameters and headers
No path, query or additional request-header parameters.
Request body
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | object; {"additionalProperties":false} | Yes | — |
| $.token | string; {"maxLength":64,"minLength":64} | Yes | — |
Responses
application/json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | object; {"additionalProperties":true} | Yes | — |
| Stable error codes |
|---|
| unauthorized |
| invalid_credential |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| forbidden |
| csrf |
| invalid_origin |
| workspace_scope |
| confirmation_required |
| invalid_confirmation |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| not_found |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| already_invited |
| version_conflict |
| idempotency_conflict |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| invalid_input |
| invalid_token |
| invalid_reference |
| invalid_action |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| member_limit |
| rate_limited |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
| Stable error codes |
|---|
| unavailable |
| feature_unavailable |
application/problem+json
| Field | Type and limits | Required | Meaning |
|---|---|---|---|
| $ | Problem | Yes | — |
| $.code | string | Yes | Stable machine-readable error code |
| $.detail | string | Yes | Short localized explanation without internal error details |
| $.instance | string | Yes | Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource |
| $.message | string | Yes | Temporarily identical to detail for existing clients |
| $.message_key | string | Yes | Stable translation key for changing the displayed language without another request |
| $.message_params | object; {"additionalProperties":true} | Yes | Named, safely rendered message parameters; never arbitrary HTML |
| $.request_id | string; {"pattern":"^[0-9a-f]{32}$"} | Yes | Server-generated diagnostic identifier. It contains no login token or credential. |
| $.status | integer; {"maximum":599,"minimum":400} | Yes | — |
| $.title | string | Yes | Localized HTTP status title |
| $.type | string; {"const":"about:blank"} | Yes | — |
Retries and asynchronous work
This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.
Request examples
Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.
Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.
curl --fail-with-body --request POST --header @"$HOME/.config/metribeacon/headers.txt" --header 'Content-Type: application/json' --data-binary '{"token":"0000000000000000000000000000000000000000000000000000000000000000"}' "https://metribeacon.com/api/v1/workspace-invitations/accept"import json, os, urllib.request
request = urllib.request.Request("https://metribeacon.com/api/v1/workspace-invitations/accept", method="POST", headers={"Cookie": os.environ["MB_COOKIE"], "X-CSRF-Token": os.environ["MB_CSRF"], "Content-Type": "application/json"}, data=json.dumps({'token': '0000000000000000000000000000000000000000000000000000000000000000'}).encode())
with urllib.request.urlopen(request, timeout=30) as response:
print(json.load(response))const response = await fetch("https://metribeacon.com/api/v1/workspace-invitations/accept", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrfToken}, body: JSON.stringify({"token":"0000000000000000000000000000000000000000000000000000000000000000"})});
console.log(response.status, await response.json());package main
import ("fmt"; "net/http"; "os"; "strings"; "time")
func main() { client := &http.Client{Timeout:30*time.Second}; request, err := http.NewRequest("POST", "https://metribeacon.com/api/v1/workspace-invitations/accept", strings.NewReader("{\"token\":\"0000000000000000000000000000000000000000000000000000000000000000\"}")); if err != nil { panic(err) }; request.Header.Set("Cookie", os.Getenv("MB_COOKIE")); request.Header.Set("X-CSRF-Token",os.Getenv("MB_CSRF"));request.Header.Set("Content-Type","application/json");response,err:=client.Do(request);if err!=nil{panic(err)};defer response.Body.Close();fmt.Println(response.StatusCode) }Related guides
- HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
- GET Read workspace membership audit
Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.
- POST Invite a verified account to a workspace
Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.
- POST Revoke a pending workspace invitation
Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.