Elaichi Invites API
The Invites API from Elaichi — 3 operation(s) for invites.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elaichi-ai:elaichi-ai-invites-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Elaichi Invites API
version: 0.1.0
description: 'Control-plane HTTP API for Elaichi, the MCP control plane for SaaS teams. Authenticate with an organization API token (create one in the Elaichi app under Settings → API tokens) sent as a bearer token, plus the `X-Organization-Id` header on org-scoped routes; the MCP and OAuth endpoints use their own protocols. A few actions are deliberately not available to an API token and must be done by a person in the Elaichi app: managing API and SCIM tokens, creating an organization, approving an access request, deleting an organization, and changing the two-factor requirement. The operations concerned say so. Endpoints used only by the Elaichi app itself (sign-in, consent screens, browser redirects, inbound webhooks) are not documented.'
servers:
- url: https://api.elaichi.ai
description: Production
tags:
- name: Invites
paths:
/invite:
get:
operationId: listInvites
summary: List pending invites
tags:
- Invites
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
required:
- result
- next_cursor
- prev_cursor
properties:
result:
type: array
items:
type: object
properties:
id:
type: string
description: Invite id (`inv_…`).
email:
type: string
format: email
description: Lowercased at creation.
role_ids:
type: array
items:
type: string
description: The single role (`role_…`) the invitee receives on acceptance.
team_ids:
type: array
items:
type: string
description: Teams (`team_…`) they are added to.
status:
type: string
description: Lifecycle state; only `pending` invites can still be accepted.
expires_at:
type: string
format: date-time
description: Seven days after creation.
invited_by:
type:
- string
- 'null'
description: User id (`usr_…`) of the inviter.
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
next_cursor:
type:
- string
- 'null'
prev_cursor:
type:
- string
- 'null'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Lists pending (not yet accepted) invites, cursor-paginated. Requires `member:manage`.
security:
- bearerAuth: []
parameters:
- $ref: '#/components/parameters/OrganizationIdHeader'
- $ref: '#/components/parameters/LimitQuery'
- $ref: '#/components/parameters/CursorQuery'
post:
operationId: createInvite
summary: Create invite
tags:
- Invites
responses:
'201':
description: Created
content:
application/json:
schema:
allOf:
- type: object
properties:
id:
type: string
description: Invite id (`inv_…`).
email:
type: string
format: email
description: Lowercased at creation.
role_ids:
type: array
items:
type: string
description: The single role (`role_…`) the invitee receives on acceptance.
team_ids:
type: array
items:
type: string
description: Teams (`team_…`) they are added to.
status:
type: string
description: Lifecycle state; only `pending` invites can still be accepted.
expires_at:
type: string
format: date-time
description: Seven days after creation.
invited_by:
type:
- string
- 'null'
description: User id (`usr_…`) of the inviter.
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
- type: object
properties:
token:
type: string
description: Raw invite token — returned once, never retrievable again.
email_sent:
type: boolean
description: False when the invite email could not be delivered (the token still works).
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Emails the invitee an accept link and returns the raw `token` once so an app can also show a copy-paste link — it is stored only as a hash and cannot be read back. Valid for seven days. An invite is a deferred role assignment, so the same no-escalation rule as `PATCH /member/{userId}` applies: you may only invite with roles whose permissions you already hold. Requires `member:manage`. Inviting someone who is already a member answers 409. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers `428 step_up_required`). An organization API token is not challenged.'
security:
- bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- email
- role_ids
properties:
email:
type: string
format: email
description: Lowercased before storage.
role_ids:
type: array
minItems: 1
maxItems: 1
items:
type: string
description: Exactly one role (`role_…`), granted on acceptance.
team_ids:
type: array
maxItems: 50
items:
type: string
description: Teams (`team_…`) to join. Defaults to none.
parameters:
- $ref: '#/components/parameters/OrganizationIdHeader'
/invite/{id}/resend:
post:
operationId: resendInvite
summary: Resend a pending invite
tags:
- Invites
responses:
'200':
description: Resent
content:
application/json:
schema:
allOf:
- type: object
properties:
id:
type: string
description: Invite id (`inv_…`).
email:
type: string
format: email
description: Lowercased at creation.
role_ids:
type: array
items:
type: string
description: The single role (`role_…`) the invitee receives on acceptance.
team_ids:
type: array
items:
type: string
description: Teams (`team_…`) they are added to.
status:
type: string
description: Lifecycle state; only `pending` invites can still be accepted.
expires_at:
type: string
format: date-time
description: Seven days after creation.
invited_by:
type:
- string
- 'null'
description: User id (`usr_…`) of the inviter.
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
- type: object
properties:
token:
type: string
description: Raw invite token — returned once, never retrievable again.
email_sent:
type: boolean
description: False when no invite email went out (the token still works).
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Mints a fresh token and a fresh 7-day expiry for a pending invite, swapped onto the same row — the invite id is unchanged and the previous link stops working. The answer to "the invite email never arrived": creating the same invite again is refused as a duplicate (`409`), so this is the route that sends a new link. The raw `token` comes back once, as on create. The caller''s own grant ceiling is re-checked against the invite''s role, so resending can never hand out a role the caller could not grant. Requires `member:manage`. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers `428 step_up_required`). An organization API token is not challenged.'
security:
- bearerAuth: []
parameters:
- $ref: '#/components/parameters/OrganizationIdHeader'
- name: id
in: path
required: true
schema:
type: string
description: Invite id (`inv_…`).
/invite/{id}:
delete:
operationId: deleteInvite
summary: Revoke a pending invite
tags:
- Invites
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/Success'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Revokes a pending invite. Irreversible: the emailed link stops working immediately. Requires `member:manage`. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers `428 step_up_required`). An organization API token is not challenged. A factor proved in the last ten minutes satisfies it, so revoking several invites in a row prompts once.'
security:
- bearerAuth: []
parameters:
- $ref: '#/components/parameters/OrganizationIdHeader'
- name: id
in: path
required: true
schema:
type: string
description: Invite id (`inv_…`).
components:
schemas:
Success:
type: object
required:
- success
properties:
success:
type: boolean
Error:
type: object
required:
- error
description: The Elaichi error envelope. The MCP OAuth endpoints under `/oauth` are the exception — they return RFC 6749 errors instead (see `OAuthError`).
properties:
error:
type: object
required:
- message
- code
properties:
message:
type: string
description: Human-readable. 5xx messages are deliberately generic.
code:
type: string
description: Stable machine-readable code, e.g. `not_found`, `subscription_required`.
details:
description: Structured detail for codes that carry one, e.g. `toolboxes_need_resolution`.
feature:
type: string
description: The gated feature, on entitlement failures.
plan:
type:
- string
- 'null'
enum:
- personal
- gold
- black
- null
additionalProperties: true
parameters:
OrganizationIdHeader:
name: X-Organization-Id
in: header
required: false
description: Target organization (`org_…`). Required for cookie/session auth on org-scoped routes; optional for API tokens, which carry their organization, and rejected when it names a different one.
schema:
type: string
CursorQuery:
name: cursor
in: query
required: false
description: Opaque cursor — pass the `next_cursor` from a previous response. Ignored by unpaginated endpoints.
schema:
type: string
LimitQuery:
name: limit
in: query
required: false
description: Page size. Defaults to 50. Values above 200 are silently clamped to 200 rather than rejected; a value below 1, or a non-integer, is a 400. Ignored by the endpoints documented as unpaginated.
schema:
type: integer
minimum: 1
maximum: 200
default: 50
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: session or API token
description: '`Authorization: Bearer <token>` with an org-scoped API token (`elch_{org_id}_{64 hex}`), created in the Elaichi app under Settings → API tokens. The Elaichi app itself signs in with a session cookie, which is also accepted but is not meant for integrations. Two other credential families exist and are NOT interchangeable with this one: an MCP OAuth access token (`POST /mcp` only) and a SCIM token (`/scim/v2/*` only).'
mcpOAuth:
type: oauth2
description: MCP OAuth access token, used only by `POST /mcp` — not interchangeable with `bearerAuth`. Discovered per RFC 9728/8414 at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`.
flows:
authorizationCode:
authorizationUrl: https://api.elaichi.ai/oauth/authorize
tokenUrl: https://api.elaichi.ai/oauth/token
scopes:
mcp:read: Anything you can already see in Elaichi. Never secret values. It can also ask an admin for access to something restricted for you.
mcp:write: Create and change teams, roles, toolboxes, templates and connections, and share access.
mcp:destructive: Permanently delete data and remove access in Elaichi. This cannot be undone.
mcp:tools: Run tools from the toolboxes you choose next, deleting in your connected apps included. It can also ask an admin for access to something restricted for you.
openid: That you are signed in, and the user ID we use for you. Nothing else.
email: Your email address, and whether it is verified. Apps use this to check your domain.