Members and invitations

Members are the people who can sign in to an organization. You add them by email: someone who already has a minipim account joins immediately, and anyone else gets an invitation.

In the admin

Members live under System → Members. The page has two sections, Members and Invitations.

Add someone

1. Under Invitations → Add member, type their email.
2. Pick a role: admin, editor, viewer or member.
3. Click Add member.
   • If the email already has an account, the banner reads Added existing user to this organization.
   • Otherwise an invitation is created. Depending on the deployment, the banner either says Invite email sent. or shows Invite created — copy the link with a link you can share yourself.

Pending invites are listed under Pending with their link, role and expiry. Click the trash icon to revoke one. Accepted and revoked invites move to History.

Manage members

• Each row shows the member’s name, email, sign-in provider and role. Pick a different role and click Save.
• Click the trash icon to remove a member. Removing yourself asks for confirmation, because you lose access immediately.
• On your own row (marked you), the pencil icon edits your display name.

Accepting an invite: the recipient opens the link, signs in or creates an account, and clicks Accept invitation. Email invitations are also claimed automatically when someone signs in with that verified email address.

With the API

Method	Path	What it does
GET	/v1/members	List members with their user records
POST	/v1/members	Add by email: { "email", "roles": ["editor"] }
PATCH	/v1/members/{id}	Replace a member’s roles ({id} is the user id)
DELETE	/v1/members/{id}	Remove a member from this organization
GET	/v1/invitations	All invitations, including accepted and revoked
POST	/v1/invitations	Create an invitation, optionally without an email
POST	/v1/invitations/{id}/revoke	Revoke a pending invitation
POST	/v1/invitations/{token}/accept	Accept as the signed-in user

curl -X POST https://api.minipim.com/v1/members \
  -H 'Authorization: Bearer <session token>' -H 'x-organization-id: <org id>' \
  -H 'Content-Type: application/json' \
  -d '{ "email": "[email protected]", "roles": ["editor"] }'

POST /v1/members answers { "status": "member" | "invited", "userId", "invitationId", "link" }.

Rules and limits

• Emails are matched case-insensitively. Adding an address that already has a pending invite returns that invite instead of creating a second one.
• An invitation addressed to an email can only be accepted by a signed-in user whose verified email matches. An invitation created without an email is a shareable link anyone holding it can accept.
• POST /v1/invitations takes expiresInDays from 1 to 365. Without it, and for invites made from the admin, there is no expiry.
• Each invitation link works once. Re-accepting as the same user is a no-op; anyone else gets a 422.
• API keys cannot accept invitations or edit a user profile.
• An organization always keeps at least one member with the admin role. The last one cannot be removed or given a different role; the request returns 409.
• Removing a member deletes only that membership. Their account and their other organizations are untouched, and their past changes stay in the audit log.
• Membership changes can take up to about a minute to reach someone who is already signed in.
• Membership changes emit member.added, member.roles_updated and member.removed; invitations emit invitation.created, invitation.accepted and invitation.revoked.