E009: Look up invitation by token

GET /api/invitations/by-token/:token

Returns a redacted summary of an invitation so the public Accept Invite page can render context before the user signs in. The only L3 workflow callable without a tenant context; the L4 boundary skips app.org_id for this route.

Authentication

Public route gated by the invitation token in the URL. No Authorization header required.

Request

Token is in the URL. No auth header required.

Response — 200 OK

{
  "invitation": {
    "email": "newuser@example.com",
    "role": "member",
    "orgName": "Acme Co",
    "invitedBy": { "displayName": "Jane Doe" },
    "expiresAt": "...",
    "status": "pending"
  }
}

Public information only — does not expose the invitation id.

Errors

HTTP	code	Condition
404	not_found	Token is unknown.
409	invalid_transition	Invitation is expired, accepted, or revoked.

Workflow

Calls W009 Look up invitation by token.