Invitations

List pending invitations

members.invitations.list

Lists the invitations to this organization that are still pending and valid (an invitation lasts 30 days; expired ones and invitations to people who already joined are left out), newest first, paginated by cursor. Each one carries the email, the role it grants, who invited, when it expires, how many times its email was sent and accept_url, the link the person opens to join (they must sign in with the invited email). Owner or admin only.

Scope

members:read

Permission

View the module · Only owner, admin

MCP tool

members_invitations_listOn the full surface; on the compact one, mb_execute_operation with id: "members.invitations.list".

Declared cost: up to 501 reads and 0 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl "https://api.mb-suite.com/v1/members/invitations" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl "https://api.mb-suite.com/v1/members/invitations" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Invite someone by email

members.invitations.create

Creates an invitation to join this organization with a role (default member; owner only for owners, 403 role_required with details.roles [owner]; through an API key or an app, at most member, 403 role_above_credential_ceiling: inviting an admin or an owner is done in MB Suite, signed in) and, unless send_email is false, emails it from MB Suite in the inviter's language (the organization name and the inviter come from the server). The person joins by opening accept_url signed in with that email; the invitation lasts 30 days. If a valid pending invitation already exists for that email it is returned as is (created false, nothing sent: use members.invitations.resend). 409 already_member if the email already belongs to a member. Outside the app, when it sends the email (send_email true, the default) it runs as a dry run first (it checks those rules and says who gets the email) and needs the confirm_token; with send_email false nothing goes out and the dry run is optional. Owner or admin only.

Needs confirmation: first dry_run: true (preview and confirm_token, valid 10 minutes and for one run), then the same body with confirm_token. In a few operations only with certain data: the description says when. Why and how: Dry run and confirm_token. In this one, only when: send_email is true (the invitation email goes out).

Scope

members:write

Permission

Edit in the module · Only owner, admin

MCP tool

members_invitations_createOn the full surface; on the compact one, mb_execute_operation with id: "members.invitations.create".

Events it can emit

members.invitation.created

Declared cost: up to 24 reads and 2 writes per call (they count against the daily quota). Touches an external platform (ses): it counts against the external operations quota.

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/members/invitations" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "ana@example.com",
  "dry_run": true
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset. In the practice organization this operation is not simulated (it reaches another platform): it answers 409 sandbox_external_unavailable.

Send the invitation email again

members.invitations.resend

Emails a pending invitation again from MB Suite, with the organization name of today and the original inviter. At most once a minute per invitation (429 cooldown_active, details.retry_after in seconds) and ten times in total (409 limit_reached, details.resource invitation_emails); an expired invitation cannot be resent (409 invitation_expired: cancel it and invite again). 404 invitation_not_found if it is not in this organization. If the email provider does not send it (details.platform ses: 503 external_unavailable or 429 external_rate_limited, retry later; 409 external_rejected when it refuses the address), the invitation is unchanged and retrying sends it again; 409 external_outcome_unknown when the provider did not answer and the email may have gone out (check before resending). Owner or admin only.

Needs confirmation: first dry_run: true (preview and confirm_token, valid 10 minutes and for one run), then the same body with confirm_token. In a few operations only with certain data: the description says when. Why and how: Dry run and confirm_token.

Scope

members:write

Permission

Edit in the module · Only owner, admin

MCP tool

members_invitations_resendOn the full surface; on the compact one, mb_execute_operation with id: "members.invitations.resend".

Declared cost: up to 2 reads and 1 writes per call (they count against the daily quota). Touches an external platform (ses): it counts against the external operations quota.

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/members/invitations/{invitation_id}/resend" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "dry_run": true
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset. In the practice organization this operation is not simulated (it reaches another platform): it answers 409 sandbox_external_unavailable.

Cancel a pending invitation

members.invitations.cancel

Cancels a pending invitation: its link stops working at once. There is no trash for an invitation (to invite the person again, create a new one), so outside the app it always needs a dry run and a confirm_token. 404 invitation_not_found if it is not in this organization; 409 invitation_not_pending if it was already accepted or declined. Owner or admin only.

Needs confirmation: first dry_run: true (preview and confirm_token, valid 10 minutes and for one run), then the same body with confirm_token. In a few operations only with certain data: the description says when. Why and how: Dry run and confirm_token.

Scope

members:write and “Allow deletions” (members:delete in OAuth)

Permission

Edit in the module · Only owner, admin

MCP tool

members_invitations_cancelOn the full surface; on the compact one, mb_execute_operation with id: "members.invitations.cancel".

Declared cost: up to 1 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X DELETE "https://api.mb-suite.com/v1/members/invitations/{invitation_id}" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "dry_run": true
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X DELETE "https://api.mb-suite.com/v1/members/invitations/{invitation_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "dry_run": true
}'