Mints an invite code and returns it, once.
Why this exists when the CLI already does it
The command line is the rescue path: it works with the service stopped and needs nothing but the database file. This is the ordinary path, because inviting a friend should not need a shell on the box.
Errors
400 when uses is below one or the lifetime is beyond a calendar, 401
when nothing was signed in, 403 when the caller is not an administrator or
used a bearer token, 404 when this instance has no administration.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of POST /admin/invites.
expires_in_days?|How many days it lasts, or null for one that never expires.
int640 <= valuenote?|What to call it, so a list of them means something.
uses*integerHow many accounts this code may create.
One code with several places is the point: something to send to a group
instead of a code per person. 1 makes it single-use.
int641 <= valueThe invite, with its code
application/json- response
A freshly minted invite, with its code.
active*booleanWhether it would still admit an account.
Sent, not left to the client to work out from used, max_uses
and expires_at against its own clock, the same reason a session says
whether it is active.
created_at*stringWhen it was made.
expires_at?|When it stops working, or null for one that does not.
id*stringStable identifier, for revoking it.
max_uses*integerHow many accounts it may create.
int64note?|What the operator called it.
used*integerHow many it has created.
int64code*stringShown once. Only its SHA-256 digest is stored, so this value cannot be read back afterwards, not even by an administrator.
curl -X POST 'https://example.com/api/v1/admin/invites' \ -H 'Content-Type: application/json' \ -d '{ "uses": 1}'{ "active": true, "created_at": "string", "expires_at": "string", "id": "string", "max_uses": 0, "note": "string", "used": 0, "code": "string"}