curl -X POST "https://api.scanova.io/multi-users/accept-invitation/" \
-H "Content-Type: application/json" \
-d '{
"hash": "a1b2c3d4e5f6...",
"password1": "correct-horse-battery-staple",
"password2": "correct-horse-battery-staple"
}'
"Invitation accepted"
Shared Users & Roles
Accept a shared-user invitation
POST /multi-users/accept-invitation/
POST
/
multi-users
/
accept-invitation
/
curl -X POST "https://api.scanova.io/multi-users/accept-invitation/" \
-H "Content-Type: application/json" \
-d '{
"hash": "a1b2c3d4e5f6...",
"password1": "correct-horse-battery-staple",
"password2": "correct-horse-battery-staple"
}'
"Invitation accepted"
Accepts a shared-user invitation and sets the teammate’s password, on the Management API host (
api.scanova.io).
POST https://api.scanova.io/multi-users/accept-invitation/
Unlike every other endpoint on this page, this one does not take a Management API key — it’s
AllowAny. It’s meant to be called from the invited teammate’s own browser, from the link in their invitation email, not from the inviting account’s integration.string
required
The invitation hash from the emailed link, max 250 characters.
string
required
The teammate’s new password.
string
required
Password confirmation — must match
password1.curl -X POST "https://api.scanova.io/multi-users/accept-invitation/" \
-H "Content-Type: application/json" \
-d '{
"hash": "a1b2c3d4e5f6...",
"password1": "correct-horse-battery-staple",
"password2": "correct-horse-battery-staple"
}'
"Invitation accepted"
Hash validity
A hash is valid only if it exists, hasn’t already been used, and was sent within the account’s configured invitation-link-validity window — both the original invite and any resend refresh the timestamp this window is measured from.400 with "Verification link is invalid or expired." if the hash fails any of those checks, or if the two passwords don’t match or fail password policy.
Related
- Invite a shared user — where the hash in the emailed link comes from.
- Resend a shared-user’s invitation email — get a fresh hash if the original expired.
- Management API overview — the auth scheme this endpoint deliberately does not use.
Was this page helpful?