Validate and activate an invitation

Preview a supplied invitation

POST /api/v1/invite-validation

Return invite, Pricing, ticket and team context without activating them. The call updates IP/resource/action flood-counter cache; it is not entirely without writes.

Before you call

Guest ACL permits this action with a valid resource header. An optional member token supplies the session email only if no truthy email input is supplied. Read the checks; a caller-supplied email comparison is not verified identity. Rate threshold is 50 in the cached action/resource/IP counter; no fixed reset window promised.

Request

Prefer JSON. If the decoded JSON is empty or otherwise false in a boolean check, the handler uses posted form fields.

Result

HTTP 200 JSON.

curl -X POST "${WALLKIT_API_BASE}/api/v1/invite-validation" \
  -H "resource: ${RESOURCE_KEY}" \
  -H "Content-Type: application/json" \
  --data-raw '{"invite": "SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001", "email": "reader@example.com"}'

const response = await fetch(`${process.env.WALLKIT_API_BASE}/api/v1/invite-validation`, {
  method: "POST", headers: { "resource": process.env.RESOURCE_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({"invite": "SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001", "email": "reader@example.com"})
});
console.log(response.status, await response.json());

import os, json
from urllib.request import Request, urlopen
from urllib.error import HTTPError

body = {'invite': 'SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001', 'email': 'reader@example.com'}
request = Request(os.environ["WALLKIT_API_BASE"] + "/api/v1/invite-validation",
    data=json.dumps(body).encode("utf-8"), headers={"resource": os.environ["RESOURCE_KEY"], "Content-Type": "application/json"}, method="POST")
try:
    with urlopen(request) as response:
        print(response.status, json.load(response))
except HTTPError as error:
    print(error.code, json.load(error))

{
  "result": true,
  "email": "reader@example.com",
  "invite": {
    "title": "Invite for Example Media team",
    "description": "Invite for Example Media team",
    "code": "SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001",
    "start_date": null,
    "end_date": null
  },
  "ticket": null
}

{
  "error": "invalid_invite",
  "error_description": "Invite usage limit has been reached."
}

Accept the invitation as the intended member

POST /api/v1/invite-activation

Record activation and conditionally attach team/Pricing relationships. It can replace existing memberships; result:true is not a provider payment or content-access decision.

Before you call

The ACL lists this action for guests, but the action requires an active member and resource. Resolve the intended invitee using their existing token/resource context, including configured Firebase handling when applicable. The comparison email comes from that member, not a body field. The invitation checks run again.

Record selection: validation is resource-scoped, but activation then looks up the code without resource scope. Duplicate codes across resources can therefore select a different record.

Writes: the action starts a database transaction, attempts an unchecked activation save, and creates or reactivates a team relationship as active/user. This can overwrite an existing role. It can also set the person’s lock-prevention setting and attempt notification events.

Membership: a team Pricing fallback or free invitation Pricing can create a membership. The paid invitation Pricing branch has no active checkout implementation and can return success without granting that Pricing. The membership helper can replace same-Plan/same-team relationships and write history. With the resource’s single_subscription setting, it can remove other resource memberships and clear or stop associated sponsorships. Pricing, team and invite end dates affect the new membership.

Nested transactions, unchecked saves and external event queues do not guarantee atomic rollback or delivered notifications. No ticket-pass creation branch exists here, even when validation returns ticket information.

Request

Prefer JSON. If the decoded JSON is empty or otherwise false in a boolean check, the handler uses the posted form invite.

Result

HTTP 200 JSON:

curl -X POST "${WALLKIT_API_BASE}/api/v1/invite-activation" \
  -H "resource: ${RESOURCE_KEY}" \
  -H "token: ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  --data-raw '{"invite": "SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001"}'

const response = await fetch(`${process.env.WALLKIT_API_BASE}/api/v1/invite-activation`, {
  method: "POST", headers: { "resource": process.env.RESOURCE_KEY, "token": process.env.USER_TOKEN, "Content-Type": "application/json" },
  body: JSON.stringify({"invite": "SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001"})
});
console.log(response.status, await response.json());

import os, json
from urllib.request import Request, urlopen
from urllib.error import HTTPError

body = {'invite': 'SYNTHETIC-INVITE-CODE-DO-NOT-USE-0000000001'}
request = Request(os.environ["WALLKIT_API_BASE"] + "/api/v1/invite-activation",
    data=json.dumps(body).encode("utf-8"), headers={"resource": os.environ["RESOURCE_KEY"], "token": os.environ["USER_TOKEN"], "Content-Type": "application/json"}, method="POST")
try:
    with urlopen(request) as response:
        print(response.status, json.load(response))
except HTTPError as error:
    print(error.code, json.load(error))

{
  "result": true,
  "subscription_id": null
}

{
  "error": "invalid_invite",
  "error_description": "You have already used this invitation."
}