2020-11-05 00:09:16 +00:00
---
stage: Growth
group: Expansion
2020-11-26 06:09:20 +00:00
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-11-05 00:09:16 +00:00
---
2021-06-11 09:09:58 +00:00
# Invitations API **(FREE)**
2020-11-05 00:09:16 +00:00
2020-11-16 15:09:23 +00:00
Use the Invitations API to send email to users you want to join a group or project, and to list pending
invitations.
2020-11-05 00:09:16 +00:00
## Valid access levels
To send an invitation, you must have access to the project or group you are sending email for. Valid access
levels are defined in the `Gitlab::Access` module. Currently, these levels are valid:
- No access (`0`)
2020-12-14 21:09:47 +00:00
- Minimal access (`5`) ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/220203) in GitLab 13.5.)
2020-11-05 00:09:16 +00:00
- Guest (`10`)
- Reporter (`20`)
- Developer (`30`)
- Maintainer (`40`)
- Owner (`50`) - Only valid to set for groups
2020-12-04 21:09:29 +00:00
WARNING:
2020-11-05 00:09:16 +00:00
Due to [an issue ](https://gitlab.com/gitlab-org/gitlab/-/issues/219299 ),
2020-11-19 00:09:41 +00:00
projects in personal namespaces don't show owner (`50`) permission.
2020-11-05 00:09:16 +00:00
## Invite by email to group or project
Invites a new user by email to join a group or project.
```plaintext
POST /groups/:id/invitations
POST /projects/:id/invitations
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
2021-06-28 15:08:03 +00:00
| `id` | integer/string | yes | The ID or [URL-encoded path of the project or group ](index.md#namespaced-path-encoding ) owned by the authenticated user |
2021-02-19 03:10:49 +00:00
| `email` | string | yes | The email of the new member or multiple emails separated by commas |
2020-11-05 00:09:16 +00:00
| `access_level` | integer | yes | A valid access level |
| `expires_at` | string | no | A date string in the format YEAR-MONTH-DAY |
2021-05-27 12:10:56 +00:00
| `invite_source` | string | no | The source of the invitation that starts the member creation process. See [this issue ](https://gitlab.com/gitlab-org/gitlab/-/issues/327120 ). |
2021-07-22 21:09:40 +00:00
| `areas_of_focus` | string | no | Areas the inviter wants the member to focus upon. |
2021-10-25 12:10:19 +00:00
| `tasks_to_be_done` | array of strings | no | Tasks the inviter wants the member to focus on. The tasks are added as issues to a specified project. The possible values are: `ci` , `code` and `issues` . If specified, requires `tasks_project_id` . [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69299 ) in GitLab 14.5 [with a flag ](../administration/feature_flags.md ) named `invite_members_for_task` . Disabled by default. |
| `tasks_project_id` | integer | no | The project ID in which to create the task issues. If specified, requires `tasks_to_be_done` . [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69299 ) in GitLab 14.5 [with a flag ](../administration/feature_flags.md ) named `invite_members_for_task` . Disabled by default. |
2020-11-05 00:09:16 +00:00
```shell
2021-06-02 15:09:59 +00:00
curl --request POST --header "PRIVATE-TOKEN: < your_access_token > " \
--data "email=test@example.com& access_level=30" "https://gitlab.example.com/api/v4/groups/:id/invitations"
curl --request POST --header "PRIVATE-TOKEN: < your_access_token > " \
--data "email=test@example.com& access_level=30" "https://gitlab.example.com/api/v4/projects/:id/invitations"
2020-11-05 00:09:16 +00:00
```
Example responses:
When all emails were successfully sent:
```json
{ "status": "success" }
```
When there was any error sending the email:
```json
{
"status": "error",
"message": {
2021-04-07 21:09:01 +00:00
"test@example.com": "Invite email has already been taken",
"test2@example.com": "User already exists in source"
2020-11-05 00:09:16 +00:00
}
}
```
2020-11-16 15:09:23 +00:00
## List all invitations pending for a group or project
Gets a list of invited group or project members viewable by the authenticated user.
Returns invitations to direct members only, and not through inherited ancestors' groups.
This function takes pagination parameters `page` and `per_page` to restrict the list of users.
```plaintext
GET /groups/:id/invitations
GET /projects/:id/invitations
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
2021-06-28 15:08:03 +00:00
| `id` | integer/string | yes | The ID or [URL-encoded path of the project or group ](index.md#namespaced-path-encoding ) owned by the authenticated user |
2020-11-16 15:09:23 +00:00
| `page` | integer | no | Page to retrieve |
| `per_page` | integer | no | Number of member invitations to return per page |
| `query` | string | no | A query string to search for invited members by invite email. Query text must match email address exactly. When empty, returns all invitations. |
```shell
curl --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/groups/:id/invitations?query=member@example.org"
curl --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/:id/invitations?query=member@example.org"
```
Example response:
```json
[
{
"id": 1,
"invite_email": "member@example.org",
2020-12-08 09:09:41 +00:00
"created_at": "2020-10-22T14:13:35Z",
2020-11-16 15:09:23 +00:00
"access_level": 30,
"expires_at": "2020-11-22T14:13:35Z",
"user_name": "Raymond Smith",
"created_by_name": "Administrator"
},
]
```
2021-01-19 12:10:46 +00:00
2021-03-05 09:09:07 +00:00
## Update an invitation to a group or project
Updates a pending invitation's access level or access expiry date.
```plaintext
PUT /groups/:id/invitations/:email
PUT /projects/:id/invitations/:email
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
2021-06-28 15:08:03 +00:00
| `id` | integer/string | yes | The ID or [URL-encoded path of the project or group ](index.md#namespaced-path-encoding ) owned by the authenticated user. |
2021-03-05 09:09:07 +00:00
| `email` | string | yes | The email address to which the invitation was previously sent. |
2021-07-08 18:09:32 +00:00
| `access_level` | integer | no | A valid access level (defaults: `30` , the Developer role). |
2021-03-05 09:09:07 +00:00
| `expires_at` | string | no | A date string in ISO 8601 format (`YYYY-MM-DDTHH:MM:SSZ`). |
```shell
curl --request PUT --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/groups/55/invitations/email@example.org?access_level=40"
curl --request PUT --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/55/invitations/email@example.org?access_level=40"
```
Example response:
```json
{
"expires_at": "2012-10-22T14:13:35Z",
"access_level": 40,
}
```
2021-01-19 12:10:46 +00:00
## Delete an invitation to a group or project
Deletes a pending invitation by email address.
```plaintext
DELETE /groups/:id/invitations/:email
DELETE /projects/:id/invitations/:email
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
2021-06-28 15:08:03 +00:00
| `id` | integer/string | yes | The ID or [URL-encoded path of the project or group ](index.md#namespaced-path-encoding ) owned by the authenticated user |
2021-01-19 12:10:46 +00:00
| `email` | string | yes | The email address to which the invitation was previously sent |
```shell
curl --request DELETE --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/groups/55/invitations/email@example.org"
curl --request DELETE --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/55/invitations/email@example.org"
```
- Returns `204` and no content on success.
- Returns `403` forbidden if unauthorized to delete the invitation.
- Returns `404` not found if authorized and no invitation is found for that email address.
- Returns `409` if the request was valid but the invitation could not be deleted.