---
title: "List the invitations"
description: "The organization's pending invitations, newest first, and whether the caller may revoke each.\n\n- **Scope:** `account:members:read`\n- **Credentials:** an API key, a client-credentials token or a person's access token\n- **Effect:** read-only; safe to retry\n- **Limits:** response up to 256 KB\n- **CLI:** `arbol account invitations list` · **MCP tool:** `account_invitations_list`"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.getarbol.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Account API › Invitations

`GET /v1/account/invitations`

The organization's pending invitations, newest first, and whether the caller may revoke each.

- **Scope:** `account:members:read`
- **Credentials:** an API key, a client-credentials token or a person's access token
- **Effect:** read-only; safe to retry
- **Limits:** response up to 256 KB
- **CLI:** `arbol account invitations list` · **MCP tool:** `account_invitations_list`

## Authentication

Requires one of the following:

- `arbolHuman`, oauth2, scopes: `account:members:read`
- `arbolMachine`, oauth2, scopes: `account:members:read`
- `arbolApiKey`, http, header `Authorization`

## Query parameters

- `cursor` (`account.invitations.list.query.cursor`; string, optional) — Opaque cursor returned by pageInfo; omit it to request the first page.
- `direction` (`account.invitations.list.query.direction`; string, optional) — Direction to traverse the stable keyset ordering from the supplied cursor.
  - one of `"forward"`, `"backward"`; default `"forward"`
- `limit` (`account.invitations.list.query.limit`; integer, optional) — Maximum items returned in one page. Defaults to 25; larger reads require another cursor.
  - min 1; max 100; default `25`

## Code samples

### cURL

```bash
curl https://api.getarbol.com/v1/account/invitations \
  --header "Authorization: Bearer $ARBOL_API_KEY"
```

### TypeScript

```typescript
import { createClient } from "@arbol-ai/sdk";

const arbol = createClient({
  baseUrl: "https://api.getarbol.com",
  token: process.env.ARBOL_API_KEY!,
});

const { data } = await arbol.account.invitations.list();
```

### Rust

```rust
use arbol_sdk::{types, Client, Credential};

let arbol = Client::new(Credential::ApiKey(std::env::var("ARBOL_API_KEY")?))?;

let data = arbol
    .account()
    .invitations()
    .list(&types::AccountInvitationsListInput::default())
    .await?;
```

### CLI

```bash
arbol account invitations list
```

### MCP

```json
{
  "name": "account_invitations_list",
  "arguments": {}
}
```

## Responses

### 200

Successful operation.

#### Example

```json
{
  "success": true,
  "data": {
    "data": [
      {
        "id": "string",
        "email": "string",
        "roles": [
          {
            "product": "raiz",
            "role": "string"
          }
        ],
        "createdAt": "2019-08-24T14:15:22Z",
        "expiresAt": "2019-08-24T14:15:22Z",
        "revocable": true
      }
    ],
    "object": "list",
    "pageInfo": {
      "hasNextPage": true,
      "hasPreviousPage": true,
      "nextCursor": "string",
      "previousCursor": "string"
    }
  },
  "error": null,
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.200.success`; boolean, required)
  - one of `true`
- `data` (`account.invitations.list.response.200.data`; object, required)
  - `data` (`account.invitations.list.response.200.data.data`; array<object>, required) — Items admitted by this resource contract within the verified organization.
    - `id` (`account.invitations.list.response.200.data.data.id`; string, required)
      - minLength 1; maxLength 256
    - `email` (`account.invitations.list.response.200.data.data.email`; string, required)
      - maxLength 320
    - `roles` (`account.invitations.list.response.200.data.data.roles`; array<object>, required)
      - `product` (`account.invitations.list.response.200.data.data.roles.product`; string, required) — A product whose team Account administers: Raíz, Agenda, Ámbar or Account itself.
        - one of `"raiz"`, `"agenda"`, `"ambar"`, `"account"`
      - `role` (`account.invitations.list.response.200.data.data.roles.role`; string, required) — A role name, such as calendar:operator.
        - minLength 1; maxLength 128
    - `createdAt` (`account.invitations.list.response.200.data.data.createdAt`; string, required)
      - format `date-time`
    - `expiresAt` (`account.invitations.list.response.200.data.data.expiresAt`; string, required)
      - format `date-time`
    - `revocable` (`account.invitations.list.response.200.data.data.revocable`; boolean, required) — Whether the caller may revoke it.
  - `object` (`account.invitations.list.response.200.data.object`; string, required) — Discriminator for a resource list response.
  - `pageInfo` (`account.invitations.list.response.200.data.pageInfo`; object, required) — Opaque navigation cursors for this page’s stable keyset order.
    - `hasNextPage` (`account.invitations.list.response.200.data.pageInfo.hasNextPage`; boolean, required) — Whether a later page exists in the current ordering.
    - `hasPreviousPage` (`account.invitations.list.response.200.data.pageInfo.hasPreviousPage`; boolean, required) — Whether an earlier page exists in the current ordering.
    - `nextCursor` (`account.invitations.list.response.200.data.pageInfo.nextCursor`; string | null, required) — Opaque cursor for the next page, or null when there is none.
    - `previousCursor` (`account.invitations.list.response.200.data.pageInfo.previousCursor`; string | null, required) — Opaque cursor for the previous page, or null when there is none.
- `error` (`account.invitations.list.response.200.error`; unknown, required)
- `metadata` (`account.invitations.list.response.200.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.200.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 400

`INVALID_INPUT`: The request does not match the published schema.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "INVALID_INPUT",
    "message": "string",
    "retryable": false,
    "data": {
      "issues": [
        {
          "path": "string",
          "message": "string"
        }
      ]
    }
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.400.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.400.data`; unknown, required)
- `error` (`account.invitations.list.response.400.error`; object, required) — The request does not match the published schema.
  - `code` (`account.invitations.list.response.400.error.code`; string, required) — The failure code, stable across releases.
    - one of `"INVALID_INPUT"`
  - `message` (`account.invitations.list.response.400.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.400.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.400.error.data`; object, required)
    - `issues` (`account.invitations.list.response.400.error.data.issues`; array<object>, optional)
      - `path` (`account.invitations.list.response.400.error.data.issues.path`; string, required) — RFC 6901 JSON Pointer to the refused field; empty for the whole input.
        - maxLength 256
      - `message` (`account.invitations.list.response.400.error.data.issues.message`; string, required)
        - maxLength 256
- `metadata` (`account.invitations.list.response.400.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.400.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 401

`UNAUTHORIZED`: A valid access token is required.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.401.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.401.data`; unknown, required)
- `error` (`account.invitations.list.response.401.error`; object, required) — A valid access token is required.
  - `code` (`account.invitations.list.response.401.error.code`; string, required) — The failure code, stable across releases.
    - one of `"UNAUTHORIZED"`
  - `message` (`account.invitations.list.response.401.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.401.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.401.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.401.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.401.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 403

`FORBIDDEN`: The token does not authorize this operation.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "FORBIDDEN",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.403.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.403.data`; unknown, required)
- `error` (`account.invitations.list.response.403.error`; object, required) — The token does not authorize this operation.
  - `code` (`account.invitations.list.response.403.error.code`; string, required) — The failure code, stable across releases.
    - one of `"FORBIDDEN"`
  - `message` (`account.invitations.list.response.403.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.403.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.403.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.403.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.403.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 409

`IDENTITY_REJECTED`: The identity service refused the change.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "IDENTITY_REJECTED",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.409.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.409.data`; unknown, required)
- `error` (`account.invitations.list.response.409.error`; object, required) — The identity service refused the change.
  - `code` (`account.invitations.list.response.409.error.code`; string, required) — The failure code, stable across releases.
    - one of `"IDENTITY_REJECTED"`
  - `message` (`account.invitations.list.response.409.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.409.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.409.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.409.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.409.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 429

`RATE_LIMITED`: The request rate limit was exceeded. Try again later.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "RATE_LIMITED",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.429.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.429.data`; unknown, required)
- `error` (`account.invitations.list.response.429.error`; object, required) — The request rate limit was exceeded. Try again later.
  - `code` (`account.invitations.list.response.429.error.code`; string, required) — The failure code, stable across releases.
    - one of `"RATE_LIMITED"`
  - `message` (`account.invitations.list.response.429.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.429.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `true`
  - `data` (`account.invitations.list.response.429.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.429.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.429.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 500

`INTERNAL_ERROR`: The service could not complete the operation.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.500.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.500.data`; unknown, required)
- `error` (`account.invitations.list.response.500.error`; object, required) — The service could not complete the operation.
  - `code` (`account.invitations.list.response.500.error.code`; string, required) — The failure code, stable across releases.
    - one of `"INTERNAL_ERROR"`
  - `message` (`account.invitations.list.response.500.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.500.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.500.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.500.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.500.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 502

`OUTCOME_UNKNOWN`: The operation may have been applied; check its result before repeating it.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "OUTCOME_UNKNOWN",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.502.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.502.data`; unknown, required)
- `error` (`account.invitations.list.response.502.error`; object, required) — The operation may have been applied; check its result before repeating it.
  - `code` (`account.invitations.list.response.502.error.code`; string, required) — The failure code, stable across releases.
    - one of `"OUTCOME_UNKNOWN"`
  - `message` (`account.invitations.list.response.502.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.502.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`account.invitations.list.response.502.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.502.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.502.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 503

- `UPSTREAM_UNAVAILABLE`: The upstream service could not complete the request.
- `ACCOUNT_NOT_CONFIGURED`: Account administration is not configured yet.
- `IDENTITY_UNAVAILABLE`: The identity service did not answer.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UPSTREAM_UNAVAILABLE",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.503.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.503.data`; unknown, required)
- `error` (`account.invitations.list.response.503.error`; one of, required)
  - one of: `UpstreamUnavailableFailure`, `AccountAccountNotConfiguredFailure`, `AccountIdentityUnavailableFailure`
  - discriminator: `code`
- `metadata` (`account.invitations.list.response.503.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.503.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 504

`UPSTREAM_TIMEOUT`: The upstream service did not respond before its deadline.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UPSTREAM_TIMEOUT",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`account.invitations.list.response.504.success`; boolean, required)
  - one of `false`
- `data` (`account.invitations.list.response.504.data`; unknown, required)
- `error` (`account.invitations.list.response.504.error`; object, required) — The upstream service did not respond before its deadline.
  - `code` (`account.invitations.list.response.504.error.code`; string, required) — The failure code, stable across releases.
    - one of `"UPSTREAM_TIMEOUT"`
  - `message` (`account.invitations.list.response.504.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`account.invitations.list.response.504.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `true`
  - `data` (`account.invitations.list.response.504.error.data`; object, required) — No fields.
- `metadata` (`account.invitations.list.response.504.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`account.invitations.list.response.504.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.


Source: https://docs.getarbol.com/api/account/invitations/list/index.md