Fac-360
Organizations

Invitations sent and not yet spent

ADMIN and above, unlike the member list: a pending invitation names an address that belongs to nobody here yet.

GET
/console/v1/organizations/{organizationId}/invitations

ADMIN and above, unlike the member list: a pending invitation names an address that belongs to nobody here yet.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

organizationId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/console/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/invitations" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "invitations": [    {      "invitationId": "550a4884-8473-4f2e-a6cf-551c16767d59",      "email": "string",      "role": "OWNER",      "createdAt": "2019-08-24T14:15:22Z",      "expiresAt": "2019-08-24T14:15:22Z"    }  ]}

Revoke an organization credential DELETE DELETE

Immediate, not at expiry: auth.assert_organization_credential re-reads revoked_at on every provisioning statement. Same OWNER floor as minting, never higher, AND DELIBERATELY WITHOUT THE SECOND FACTOR the mint requires. Revocation is the emergency action -- it is what somebody does at 2am with a secret in a public repository -- and the person reaching for the kill switch is the person whose phone may be the thing that was lost. Minting creates risk and carries the friction; revoking removes risk and carries none. Unknown, already revoked, and belonging to another organization are one 404.

Invite somebody POST POST

ADMIN and above, and nobody may invite above their own rank: an ADMIN who could mint an OWNER is an ADMIN who can promote themselves through a second account. The invitation is bound to the address it names, so a forwarded link is worth nothing to anybody else.