https://linen.dev logo
Join Slack
Powered by
Attempting to use the API to fetch information abo...
# permit-saas
a
Attempting to use the API to fetch information about an invite_code.
Copy code
GET <https://api.permit.io/v2/facts/963052528a05464f81806c264751d0ea/8671f6b2ae42487fa851e9f6c43a8cbd/user_invites/fe250482c2ab403795f8312f06a48aa0>
Including Authorization Bearer header
Copy code
{
  "id": "73576d6c002d4a60bfe01d1b51ee729c",
  "title": "The request could not be completed",
  "error_code": "UNEXPECTED_ERROR",
  "message": "You did nothing wrong, but we could not finish your request due to a technical issue on our end. Please try again.\nIf the issue keeps happening, contact our support on Slack for further guidance."
}
a
Hi @Abe Clark, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
You're encountering an error when trying to fetch user invite information. Based on the available documentation, I can see there's a DELETE endpoint for user invites (1) , but I don't have documentation for a GET endpoint to retrieve user invite details. The error suggests a technical issue on Permit.io's side. Since this appears to be a bug with the API, could you please provide the following information so our engineers can investigate: 1. ​*Which Workspace / Project / Env they are using*​ - I can see you're using project 
963052528a05464f81806c264751d0ea
and environment 
8671f6b2ae42487fa851e9f6c43a8cbd
2. *What calls are they performing (as SDK code or CURL) * - You've provided the GET request, but a full CURL example would be helpful 3. ​*Which PDP version they are running*​ - Please share your PDP version 4. ​*To share relevant logs from their PDP*​ - Any logs around the time of this error For immediate support, you can reach out over Email .
To learn more, see the sources I considered: [[1] DELETE /v2/facts/{proj_id}/{env_id}/user_invites/{user_invite_id}](https://api.permit.io/v2/redoc#tag/User-Invites/operation/delete_user_invite)
a
Possible that invite_code in the email is not the same as invite_key. Will try the list endpoint first
grrr.. now it seems like the approve method doesn't exist in the node sdk? https://docs.permit.io/embeddable-uis/email-configuration-and-templates/#:~:text=Using%20the%20invite,the%20chosen%20role. Unclear how to graduate this invite_code into a user account
@Ask Inkeep Any ideas ☝️
a
Thanks for tagging me @Abe Clark. I'll look through relevant sources and get back to you shortly.
Looking at the Node.js SDK types, I can see the invite structure includes an 
invite_code
field (1) :
Copy code
/**
 * The invite code that is sent to the member\'s email
 * @type {string}
 * @memberof InviteRead
 */
invite_code: string;
The 
InviteStatus
enum shows the possible states :
Copy code
export const InviteStatus = {
  Pending: 'pending',
  Accepted: 'accepted',
  Failed: 'failed',
  Canceled: 'canceled',
} as const;
However, I don't see an 
approve
method documented in the available Node.js SDK sources. The sources show invite data structures but not the methods for approving invites. Since this appears to be a gap in functionality or documentation, could you provide: 1. Which Workspace / Project / Env you're using 2. Your exact SDK calls (the code you're trying to use) 3. Which PDP version you're running
a
@Ask Inkeep is there any other documentation that references the invite_code that would provide ideas on how to go from invite_code to user acceptance?
a
Thanks for tagging me @Abe Clark. I'll look through relevant sources and get back to you shortly.
Yes, the documentation shows how to handle invite codes and user acceptance. The Email Configuration and Templates documentation demonstrates the approval process (1) . After a user receives an invite email with a URL containing the 
invite_code
query parameter (like `https://test.com/?invite_code=ed32bc43e2194a80a5ef5e0339943b44`) , you can approve the user using an SDK . The example shows using the Python SDK :
Copy code
await permit.api.users.approve(  
 user_key="new_user",  
 email="<mailto:new-user@example.com|new-user@example.com>",  
 invite_code="ed32bc43e2194a80a5ef5e0339943b44"  
)
This approve method validates that the user has a valid email address and creates the approved user with their assigned role . The Ruby SDK documentation also shows the invite structure with an 
invite_code
field that's sent to the member's email (2) :
Copy code
instance = OpenapiClient::InviteRead.new(
  email: null,
  role: null,
  id: null,
  organization_id: null,
  invite_code: null,
  created_at: null,
  status: null,
  failed_reason: null
)
While the Node.js SDK may not have the approve method documented in the available sources, the pattern from other SDKs suggests looking for a similar users.approve() method that accepts the user_key, email, and invite_code parameters.
a
This seems to be an issue on our side, we’ve already started investigating and will revert back to you with a fix. @Abe Clark
a
Awesome, thanks @Alon Boshi
a
Hey @Abe Clark, We've found the issue, we expect a fix to be in production by the end of the week.
a
Great @Alon Boshi -- can you give some details on what the issue is / how this will work? Frankly, I'm a little unclear on what .accept would do even if it existed in the SDK? I'm actively working on the invite acceptance flow which is crucial to actually using permit, so I'd love to know how the acceptance part of that flow is supposed to work.
a
Hey @Abe Clark, The issue we found is in the API request for 
get_user_invite
. 
.approve
(I assume that’s what you meant) is responsible for creating the user and assigning the role on the tenant based on the configured 
user_invite
.
a
Gotcha -- any ideas on how I can run the approve flow when it doesn't exist in the node sdk nor in the documentation that I can see?
a
You can view the API documentation here: approve_user_invite . This API endpoint provides the same functionality as the missing SDK function.
a
Got it thanks -- I was looking at the invites section instead. I'll try this out
👍 1
@Alon Boshi Can you help me understand the flow here? I sent an invite for a ReBAC resource (workspace in my system) I used the invite_code to resolve to the following response. But, I'm unclear of two things: • Why is status: pending? • Why are there no resource instance roles or evidence of having been shared an instance? The invitation was sent using the embedded user management configured to ReBAC
Copy code
{
  "key": "test-key",
  "id": "40d471afa81a46ffb8758f5bccff941a",
  "organization_id": "dfc4d67c54f64ea79eb0ff0864c07cca",
  "project_id": "963052528a05464f81806c264751d0ea",
  "environment_id": "8671f6b2ae42487fa851e9f6c43a8cbd",
  "associated_tenants": [
    {
      "tenant": "default",
      "roles": [],
      "status": "pending",
      "resource_instance_roles": []
    }
  ],
  "roles": [],
  "created_at": "2025-08-20T19:08:36+00:00",
  "updated_at": "2025-08-20T19:08:36+00:00",
  "email": "<mailto:abeaclark+test45asdfasdfasdf@gmail.com|abeaclark+test45asdfasdfasdf@gmail.com>",
  "first_name": null,
  "last_name": null,
  "attributes": {}
}
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
o
We are actually planing to change things here following the conversation and make calling this API mandatory The user won’t be assigned the role given to it, until this API is called.
This will also fix the pending display issue that was discussed
a
Ok interesting. the payload above was from the approve endpoint. Which is why I expected it to change from pending to approved. But sounds like you're revamping it a bit. not totally clear how you're proposing using the update and approve endpoints, but I'm sure it will become more clear. One comment on the docs there -- I think many ppl won't have first/last name for users, so making those required feels a bit heavy handed. Where does this sit on the roadmap? I'm just trying to figure out how to resource this on my end. Thanks!
o
first/last name for users, so making those required feels a bit heavy handed.
This was decided back in my living room (garage mode) in 2021, and has stuck as backward compatibility 😅 But yeah maybe it’s time to change that as well CC: @Shuvy Ankor
a
haha sounds good. Product has clearly come a long way since then. I'm pretty stoked about it overall, just a few edges to iron out and feels like it will make life much easier
💜 1
On the update call, I'm also not entirely sure how I'd know what the role_id should be when resolving from elements. I'm planning to rely on permit for state management of roles and who has what role. So when I approve an invite, my hope is that the information is already embedded in the invite itself. Then when I approve, I can make any DB linkages on my end if needed (ex: add to workspace model, etc.) I'm hoping to not have to record any of that until the point that the invite is accepted. Lastly -- how does the non-email acceptance flow work? ex: I grant someone access to a google doc. Sure, we can send them an email, but when they visit the direct resource link I would expect the permissions to just resolve (assuming they are logged in). I'm hoping there is a way around needing the user to press the link in an email each time a resource is shared. I'm not sure how I would get ahold of the invite_code / approve them without that though.
o
Yes, that state is essentially what's tracked by the invite. You shouldn't need to apply it yourself. For non-email, your other options are: • trigger this with a Webhook, and you have the responsibility to direct the user to the app, login them, and invoke the approval. • Manage this manually in a push flow onto the API
a
Got it -- I'll try out the webhook route. I guess what I'm trying to accomplish is a default "accepted" invite type for users that already exist in Permit.
Promise I'm not trying to be annoying -- just working through getting this working. Some things I notice: • Even though you can toggle webhook and email on at the same time, I wasn't able to get a webhook to trigger while email was toggled on. Ideal if both can work in tandem. • The payload of the webhook still leaves me wondering about how to resolve in a ReBAC setup. Not sure if there is a secondary call I'd need to make to understand the resource that is in scope? Maybe this is covered in the work that @Shuvy Ankor is taking on once back from PTO? With the following I don't know: • which resource this is from (Workspace, Team, Task, Brand, etc.) • which resource key this is for (instance of workspace, team, task, brand, etc.)
Copy code
body: {
    email: '<mailto:abeaclark+test45sdaf@gmail.com|abeaclark+test45sdaf@gmail.com>',
    tenant_key: 'default',
    role: 'Editor',
    permission_level: 'LEVEL_2',
    type: 'create_user'
  },
o
I believe all of these are already on Shuvy's list He got back from PTO today, and started working on this
a
Amazing, thanks @Shuvy Ankor! Gonna be magic when this all connects 🎉
💪 1
👀 1
@Shuvy Ankor if you want anyone external to help test the new setup, happy to do so. just let me know. Thanks again!
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
e
Hi @Abe Clark, Thanks so much for letting us know! @Shuvy Ankor will see your message and get back to you about it at the beginning of the week.
a
Awesome!
s
Hi, @Abe Clark thank you very much for all the feedback. I'm still working on it and will update you when everything is ready.
a
Hey @Shuvy Ankor -- checking back here to see how things are progressing. I'm anxious to fully adopt permit and these ReBAC invite flows are the main blocker atm. Thanks again!
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
n
Hi @Abe Clark - thanks for following up with us. I will check with the team and will get back to you.
a
Thanks @Natalia Edelson!
s
Hi @Abe Clark Currently, we are working on this. We will update once everything has been released. We will release our first fix in the next few days, and you will be able to see the list of pending users in the user management element. As part of the second stage, we will fix rebac in invite, which currently does not work well enough.
a
Got it -- how long do you expect for the rebac part? That's more of the holdup for me since it's core to using rebac. All I really need is a way to link back the resource id to the invite
Mainly asking so I can sequence the work on my end properly
s
We’re aiming to have everything in production by mid-next week. This part of the system requires comprehensive testing before deployment.
a
Makes total sense. Really appreciate it Shuvy!
💪 2
s
@Abe Clark Our fix is almost ready. We are in the final stages before it can be put into production. I will update you as soon as possible.
a
Exciting! Thanks Shuvy!
s
We have released a major update to an element in our system, I’m pleased to share.👏🏻 1. If there is an email configuration for a user, that user’s email address is added to the invites list of users. This is now visible above your users’ headers. (in element) 2. To make a in invites-user into a regular user, you need to use the API approve function to take care of him. 3. If you use Webhook, you can add this user to your waiting list if you have an email configured. If you dont have an email configured and you only have Webhook today, this will add the user to be a regular user for the next two weeks. In two weeks from now webhook to invite user and not create user. (same like emails) 4. You will also receive a webhook if you have both a webhook and an email configured resource_instance_key in webhook . 5. Another option is to add the {resource_instance_key} to the redirect URL in email template. (in image) This will automatically add the resource_instance_key to the resource_instance_key url sent to the user’s email. — It is important to use an SMTP service that works well like Gmail. cc: @Abe Clark @Alon Boshi @Thomas @Or Weis
a
Amazing -- thanks @Shuvy Ankor I'm excited to play around with this. One thing that comes to mind is it may be nice to also include a resourceType as a url param, that way if you have a uuid, for example, you also know which resource type it corresponds to. Longer term I think it would be great to be able to specify the redirect_to i the UI config itself, so that you can customize it per invitations instance. Then, you can use the resource url in your system as the invite url for that resource as well (becomes more clear and consistent for the user) I'm excited for this. thanks!
💜 1
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
a
Just diving in to build this E2E but back to getting this on the user_invites lookup. Not sure what to change to avoid it? https://api.permit.io/v2/facts/963052528a05464f81806c264751d0ea/8671f6b2ae42487fa851e9f6c43a8cbd/user_invites/4752f71981814c9ab93af865234227e7
Copy code
{
  "id": "a925ec9a138c4770a394307692da2e90",
  "title": "The request could not be completed",
  "error_code": "UNEXPECTED_ERROR",
  "message": "You did nothing wrong, but we could not finish your request due to a technical issue on our end. Please try again.\nIf the issue keeps happening, contact our support on Slack for further guidance."
}
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
a
Also fails https://api.permit.io/v2/facts/963052528a05464f81806c264751d0ea/8671f6b2ae42487fa85[…]c43a8cbd/user_invites/4752f71981814c9ab93af865234227e7/approve
Copy code
{
  "email": "<REDACTED>",
  "key": "test-key",
  "attributes": {
    "test": "123"
  }
}
Copy code
{
  "id": "658f6066b8274e65ac8c583aab6e3b21",
  "title": "The request could not be completed",
  "error_code": "UNEXPECTED_ERROR",
  "message": "You did nothing wrong, but we could not finish your request due to a technical issue on our end. Please try again.\nIf the issue keeps happening, contact our support on Slack for further guidance."
}
o
Hi @Abe Clark, it's getting a little late in our timezone, we'll review this, next week
a
Got it thanks. Generally -- is the user management stuff production ready? I'm confused how ppl are using it without some of these things working. No need to respond today. Cheers
o
Yes it is. Been in use for years now actually. Invite pending status, while very useful is far for mandatory, though I would agree useful.
s
Hi, @Abe Clark I’ll check this and get back to you as soon as possible with a solution. Have a good week.
a
Thanks! If I'm taking an odd, untried path here, happy to hear that as well. Trying to implement this as I assume it's intended via the docs etc.
o
It's a beaten path, but in all honesty it's a not well designed one originally, and now with new changes trying to bring it back to the fold and right standard it is slightly trickier than initially expected. But we're confident a few more well positioned hammer blows would get the job done.
👍 1
s
Hi @Abe Clark A fix has been issued, I tested it, and it works. I would be happy to hear that it works for you too. The use you made was for an existing user. It means that the key exists in the system, but the email in the invite is different from the email for that user. Have a wonderful day 😉
a
Got it -- what is the expected outcome in that case? I think you're saying: User A has an account with email: A@email.com User B invites user A to a resource but sends an invite to user A's other email A@gmail.com User A opens the invite in his account A@email.com Is that the case, and if so, what is the expected resolution (will the invite work or not?) I'd ideally allow this but I get that some wouldn't want this
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
o
When you create a user invite you decide on the user key which would represent the user uniquely (this doesn't have to be an email), it's up to you to manage the correlation of the user across different invites
a
Got it -- so if I see that an invite is being redeemed, but the logged-in user doesn't match emails, then I execute logic on my end to replicate and validate the access for the logged in user if I want that to be the flow. I think that is what you are saying?
👀 1
s
Hi @Abe Clark Or, explained it well. Just to expand on their explanation: The flow works like this: 1. Email invitation through element → no user key assigned yet. 2. Approve API/SDK → you define the user key and mail.
Copy code
{
  "email": "<mailto:user@eamil.com|user@eamil.com>",
  "key": "test-key",
  "attributes": {
    "test": "123"
  }
}
3. If a user with that key exists but has a different email, we update to the new email address In your case, there was already a user with the key “test-key”, so the system updated their email accordingly.
a
got it, thank you @Shuvy Ankor super helpful!
💪 1
So is this alltogether the wrong endpoint to be using? https://api.permit.io/v2/facts/963052528a05464f81806c264751d0ea/8671f6b2ae42487fa851e9f6c43a8cbd/user_invites/4752f71981814c9ab93af865234227e7 I haven't ever had a success from it, including when I just tried it... Is it that I have to accept the invite before I can see the details of the invite? Is it b/c the code sent in the email isn't the same code that this endpoint expects? I need a way to know what the invite is for before I'm able to confidently allow acceptance
👀 1
s
Hi @Abe Clark, The process step by step: 1. Send invitation: You invite the user through the element, and they receive an invitation ID via email or webhook 2. Approve invitation: You confirm the invitation using the approve API 3. User activation: The user moves from the waiting list to an active user in your system and receives their assigned role Which of these steps isn’t working as expected for you?
a
I'm trying to read the data from the invite prior to approving. I don't understand the point of an approval API step if I can't actually understand information about the invite prior to approval
I can see the invite in the list view prior to approving, but if I try to fetch it directly I get an error
In theory I could cache this information from the webhook... but isn't the point of this endpoint for me to be able to read information about the invite? https://api.permit.io/v2/redoc#tag/User-Invites/operation/get_user_invite
s
I understand, I think you also have all the data in the list of all invites, but I’ll check the get_user_invite endpoint. Another question: If you use both email and Webhook, what other information are you missing there?
a
the resource key -- all I get is an ID and I don't know which resource type it belongs to
It means I have to make additional calls to figure that out
Re: the list -- yes the data is there, but it's not a reliable way to fetch a specific invite
Also -- perhaps I still misunderstand the flow you described here, but I get an error when I try to use a different email from the one in the invite? Your explanation made me think that was possible (given the id was not yet assigned)
Copy code
{
  detail: 'Email: <mailto:45@gmail.com|45@gmail.com> does not match the email of the invite: <mailto:999@gmail.com|999@gmail.com>'
}
https://permit-io.slack.com/archives/C02RTML2WNN/p1758051162087099?thread_ts=1755586781.430919&amp;cid=C02RTML2WNN
s
The email should match the original invitation email. However, if a user with that key already exists in the system, we’ll update their email address to the latest one provided - so the most recent email becomes their current email address.
a
ah ok got it. So basically if I want it to resolve differently, I'd need to just create the permission record manually at that point
s
Following up on your previous question: We’re actively working on improvements in this area to enhance the user experience, and your feedback is incredibly valuable to us! I wanted to share two features we’ve recently added that might help with your current workflow: 1. Email Template Variables You can now include 
resource_instance_key
directly in email links: https://docs.permit.io/embeddable-uis/email-configuration-and-templates/#templates-variables 2. Enhanced Webhooks We’ve added 
resource_instance_key
to webhooks as well. Currently, this works when email configuration is enabled, but we’re planning to make it work independently in the future: https://docs.permit.io/embeddable-uis/webhooks#rebac Hope these features help streamline your implementation!
a
Awesome yes I saw these, which make it useable. I used the term "key" earlier but I'm referring to the resource type. resourceType + resourceKey together in both of these contexts would be great. Without the resourceType, I have to do a bunch of work on my end to try to figure out the context. Even better would be to allow dynamic redirect urls -- I'd prefer to send my users a link directly to the resource (similar to when you get a google docs link) instead of an interstitial arbitrary route. This is more cosmetic and less crucial than the resourceType
Also seems odd that the approve endpoint has no trace of the resource you just approved access to https://api.permit.io/v2/redoc#tag/User-Invites/operation/approve_user_invite
👀 1
o
Why would it? If you want information on the invite, that's where the GET invite api comes in
a
😆 ok I'll wait for that to work 🙂
seems logical to me that if I approve someone to have access to a resource, that resource id would be in the resulting payload
o
Why? You approved it not read it or mutated it. Each API should return it's relevant data. The philosophy of returning every potentially associated bit of information creates slower APIs.
a
Well as it stands today, I have no idea what I approved. But yes if the GET endpoint works someday, it will solve the problem
I interpret this bit of the response as the same concept applied to RBAC
Copy code
"roles": [
{
"role": "admin",
"tenant": "stripe-inc"
},
{
"role": "viewer",
"tenant": "<http://othercompany.com|othercompany.com>"
}
]
But perhaps I'm not thinking of it the same way you are
s
I’ll check things out and issue a fix for it. (get_user_invite)
🙏 1
Hi @Abe Clark I’ve just pushed a fix for 
get_user_invite
. Please give it a try and let me know if everything works as expected - we’d really appreciate your feedback as we’re actively working on improvements in this area. Thanks!
If you need more information about the resource_instance you can get it here: https://api.permit.io/v2/redoc#tag/Resource-Instances/operation/get_resource_instance
Open in Slack
PreviousNext
Powered by