# invalid_invitation_link

The invitation link was never issued, has expired, was used or no longer applies (400).

## Meaning

`POST /v1/auth/invitation/accept` refuses a token that expired
(`auth.invitation.validity`, default `168h`), was already accepted, belongs to
another organization, was never issued, or was sent to an account that has since got
a password or another address.

## Impact

The invited user cannot set their first password with this link. It is expected for
an old invitation or one accepted already.

## Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded as
`auth.invitation.accepted` with reason `invalid_token` and cause
`invitation_link_unknown`. The user's `invitation_pending` in the admin API says
whether they still need one.

## Mitigation

- As a user: ask your administrator for a new invitation.
- As an administrator: send one with `POST /v1/admin/orgs/{slug}/users/{id}/invitation`
  or from the user's page; a user who already has a password should use "Forgot
  password" instead.

## Escalation

Escalate when a freshly sent invitation is refused on first use. Open an issue with
the request id and the server version. Never attach the link or its token.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.