Invite space member

Outcome

Record a pending addressed space invitation and its notification without changing canonical workspace grants.

Before you start

• Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
• The published application permission is workspace:write. Discover a granted Spaces workspace and bind that exact resource. Supplied identifiers do not grant access.
• Authorize the documented storage, publication, invitation, notification, metering, privacy or archival effects before CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_spaces.members.invite --detail --json
topolo resources topolo-spaces --json
topolo workspaces list topolo-spaces --json

• Select the exact granted workspace id as SPACES_WORKSPACE_ID. Fixture ids authorize no live operation.
• Discover the exact spaceId from spaces.list or a retained creation response in this workspace.
• Discover the actual canonical recipient user id through authorized identity discovery. An invitation does not grant workspace access.

Request

POST /api/spaces/{spaceId}/members/invitations

Save action input as payload.json. Inspect the plan for the exact path, query and body. Set SPACES_WORKSPACE_ID from granted resource discovery.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

View the complete input schema in the action console. The same schema is available through CLI and MCP action discovery.

Effects

• Requires a nonblank recipientUserId for the same workspace space; omitted role defaults to viewer, and editor is explicit.
• Records the pending invitation and notification outbox row in one collaboration batch. This does not grant canonical Auth workspace access or prove notification delivery.
• The database prohibits two pending invitations for the same space and recipient. A repeated pending invite produces an unstructured server error in current handlers; do not retry blindly. No invitation listing, acceptance or revocation action is published in this catalog.

Interpret the response

Use response path $.invitation.id for space_invitation. An empty list does not discover a target.

Save invitation.id and confirm pending status, exact recipientUserId and role. Verify actual canonical access and delivered notification separately. If a duplicate or ambiguous response occurs, retain the request id and investigate rather than repeating.

The success schema was checked against captured handler responses. Delegated Auth identity and canonical widget context fields can vary; exact Spaces envelopes and all thirteen SQL export table sets are source-reviewed against the migrated local schema. Error responses can be plain text; the original refusal body is retained. Error examples retain their actual refusal shapes.

View the complete success schema in the action console. The worked examples below retain complete raw captured Worker responses. CLI responses have a transport envelope and can be bounded unless --detail is requested; action discovery supplies the exact schema.

Worked examples

Real isolated local D1/R2 and source handlers with synthetic Auth/workspace discovery, queue transport, notification delivery and metering. Arbitrary fixture SOG bytes demonstrate handler state only, not valid Gaussian data, renderer quality, deployed processing or live effects. Annotation rows are seeded directly into isolated fixture storage because no annotation mutation is published. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Successful request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: minimal.

Input · payload.json:

{
  "spaceId": "space_9338e6fc-cc93-421e-a783-6c8062088e0c",
  "recipientUserId": "usr_fixture_recipient"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.members.invite",
    "input": {
      "spaceId": "space_9338e6fc-cc93-421e-a783-6c8062088e0c",
      "recipientUserId": "usr_fixture_recipient"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by granted resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "invitation": {
    "id": "spaces_invite_9c020aa9-c5a7-452b-9f15-f50421db77b0",
    "spaceId": "space_9338e6fc-cc93-421e-a783-6c8062088e0c",
    "recipientUserId": "usr_fixture_recipient",
    "role": "viewer",
    "status": "pending"
  }
}

HTTP 201. Save invitation.id and confirm pending status, exact recipientUserId and role. Verify actual canonical access and delivered notification separately. If a duplicate or ambiguous response occurs, retain the request id and investigate rather than repeating.

Refused request · HTTP 500

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: minimal.

Input · payload.json:

{
  "spaceId": "space_9338e6fc-cc93-421e-a783-6c8062088e0c",
  "recipientUserId": "usr_fixture_recipient"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 500:

Internal Server Error

HTTP 500. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Another supported request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: workflow.

Input · payload.json:

{
  "spaceId": "space_bfe6af37-3588-406b-b103-7675eb527e82",
  "recipientUserId": "usr_fixture_recipient",
  "role": "editor"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.members.invite",
    "input": {
      "spaceId": "space_bfe6af37-3588-406b-b103-7675eb527e82",
      "recipientUserId": "usr_fixture_recipient",
      "role": "editor"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by granted resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "invitation": {
    "id": "spaces_invite_c5030314-d6fd-4cce-b10d-d69449f4996e",
    "spaceId": "space_bfe6af37-3588-406b-b103-7675eb527e82",
    "recipientUserId": "usr_fixture_recipient",
    "role": "editor",
    "status": "pending"
  }
}

HTTP 201. Save invitation.id and confirm pending status, exact recipientUserId and role. Verify actual canonical access and delivered notification separately. If a duplicate or ambiguous response occurs, retain the request id and investigate rather than repeating.

Refused request · HTTP 500

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: workflow.

Input · payload.json:

{
  "spaceId": "space_bfe6af37-3588-406b-b103-7675eb527e82",
  "recipientUserId": "usr_fixture_recipient"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 500:

Internal Server Error

HTTP 500. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Another supported request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: privacy.

Input · payload.json:

{
  "spaceId": "space_858bda7b-397a-4784-979e-609961a9a16e",
  "recipientUserId": "usr_fixture_recipient"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.members.invite",
    "input": {
      "spaceId": "space_858bda7b-397a-4784-979e-609961a9a16e",
      "recipientUserId": "usr_fixture_recipient"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by granted resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "invitation": {
    "id": "spaces_invite_29016b6c-4adb-45f2-87cb-438bd5d9147f",
    "spaceId": "space_858bda7b-397a-4784-979e-609961a9a16e",
    "recipientUserId": "usr_fixture_recipient",
    "role": "viewer",
    "status": "pending"
  }
}

HTTP 201. Save invitation.id and confirm pending status, exact recipientUserId and role. Verify actual canonical access and delivered notification separately. If a duplicate or ambiguous response occurs, retain the request id and investigate rather than repeating.

Refused request · HTTP 500

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: privacy.

Input · payload.json:

{
  "spaceId": "space_858bda7b-397a-4784-979e-609961a9a16e",
  "recipientUserId": "usr_fixture_recipient"
}

CLI:

topolo actions validate app_topolo_spaces.members.invite --data @payload.json --json
topolo actions plan app_topolo_spaces.members.invite --resource-type workspace --resource-id "$SPACES_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 500:

Internal Server Error

HTTP 500. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Verify the result

• Save invitation.id and confirm pending status, exact recipientUserId and role.
• Verify actual canonical access and delivered notification separately. If a duplicate or ambiguous response occurs, retain the request id and investigate rather than repeating.

Errors and recovery

• Internal Server Error (HTTP 500): Inspect the same granted workspace and target state before preparing another request. A duplicate pending invitation violates the stored uniqueness rule; no published invitation cancellation exists. Do not retry this recipient blindly.
• organization_context_required (HTTP 403): Stop and authenticate into the approved owning organization. Preserve the actual denial; a resource id does not grant organization access.
• workspace_required (HTTP 400): Discover the exact granted canonical workspace through resource/workspace discovery; bootstrap does not return a workspace record.
• space_not_found (HTTP 404): Rediscover the exact space id in this granted workspace through spaces.list or a saved creation response; deletion or another workspace can make it unavailable.
• recipient_user_required (HTTP 400): Provide the exact nonblank canonical recipient user id from authorized discovery; whitespace input can pass the raw minLength schema but is refused after trimming.

A plain-text server refusal is surfaced by CLI/MCP as http_error with its HTTP status and requestId; its text is not a structured service error.code. Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

There is no published invitation cancellation action. Removing the entire space removes local invitation metadata but is destructive and does not revoke already granted canonical access or retract a delivered message.

Related actions

• Get space: Read one space with its stored asset, annotation, public-link and processing-job records.

Evidence

Real isolated local D1/R2 and source handlers with synthetic Auth/workspace discovery, queue transport, notification delivery and metering. Arbitrary fixture SOG bytes demonstrate handler state only, not valid Gaussian data, renderer quality, deployed processing or live effects. Annotation rows are seeded directly into isolated fixture storage because no annotation mutation is published. Capture digests and test scenarios are retained in the source fixture records.