Cowdidocs
API ReferenceMerchant members

List pending invitations

GET
/v1/merchants/{id}/invitations

List the merchant's pending member invitations. Core resolves the merchant's organization before authorization. Requires merchant:members:read on the merchant, from direct or inherited roles. Returns every match. The response is not paginated.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

id*string

The merchant ID from the sales app.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/merchants/550e8400-e29b-41d4-a716-446655440001/invitations"
[  {    "id": "550e8400-e29b-41d4-a716-446655440002",    "merchant_id": "550e8400-e29b-41d4-a716-446655440001",    "organization_id": "greenwheels",    "email": "jane@example.com",    "role": "merchant-financing-admin",    "status": "PENDING",    "created_at": "2026-03-15T10:00:00Z",    "resource_id": "string"  }]
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
[  {    "id": "550e8400-e29b-41d4-a716-446655440002",    "merchant_id": "550e8400-e29b-41d4-a716-446655440001",    "organization_id": "greenwheels",    "email": "jane@example.com",    "role": "merchant-financing-admin",    "status": "PENDING",    "created_at": "2026-03-15T10:00:00Z",    "resource_id": "string"  }]
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Get merchant access GET

Inspect one user's direct, group, and inherited assignments with provider-evaluated effective permissions. Requires `org:merchants:read`. The `user_id` filter is required. The response contains at most one person and has no pagination links. Organization members remain visible with no merchant roles.

Invite a merchant member POST

Invite an email to join the merchant with a role. Core resolves the merchant's organization before authorization. Requires `merchant:members:write` on the merchant, from direct or inherited roles. An existing pending invitation returns 200 and sends no email. A new invitation returns 201 and sends an email built from `accept_url`. The invitee accepts or rejects the invitation through their user invitation routes.