Invites
3 Invites routes on the FLAM API: Look up an invitation token before signing in; Accept an invitation as the signed-in user; Request an invitation to the.
Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.
GET /api/toolkit/invite/accept
Look up an invitation token before signing in
Answers the invited email so the sign-up screen can pre-fill it. No session needed.
Parameters
| In | Name | Type | Required | Notes |
|---|---|---|---|---|
| query | token | string | yes | — |
Responses
| Status | Meaning |
|---|---|
200 | The invited address |
400 | Token required |
404 | Invalid token |
410 | Already accepted |
200 returns:
{
"email": "string"
}Call it
curl -X GET "https://api.flam.fashion/api/toolkit/invite/accept?token=<token>" \
-H "Authorization: Bearer $FLAM_API_KEY"POST /api/toolkit/invite/accept
Accept an invitation as the signed-in user
The email on the invite must match the session's, otherwise 403 — an invite is not transferable. Accepting attaches the pre-created email-keyed grants to the caller's HOUSE and repairs a missing personal org (ensurePersonalOrg is idempotent). Replaying an accepted token is a no-op, not an error.
Request body — application/json (required)
| Field | Type | Required | Notes |
|---|---|---|---|
token | string | yes | — |
{
"token": "string"
}Responses
| Status | Meaning |
|---|---|
200 | Accepted (or already was) |
400 | Token required |
401 | No valid session |
403 | This invite is for a different email |
404 | Invalid token |
200 returns:
{
"ok": true,
"alreadyAccepted": true
}Call it
curl -X POST "https://api.flam.fashion/api/toolkit/invite/accept" \
-H "Authorization: Bearer $FLAM_API_KEY" \
-H "Content-Type: application/json" \
-d '{"token":"string"}'POST /api/toolkit/invite/request
Request an invitation to the house
Public, unauthenticated. Rate-limited per IP. A duplicate address answers 200 with status already_requested rather than an error — asking twice is not a fault.
Request body — application/json
| Field | Type | Required | Notes |
|---|---|---|---|
name | string | yes | — |
house | string | yes | — |
email | string (email) | yes | — |
collection | string | yes | — |
website | string | no | — |
{
"name": "Noa Berger",
"house": "Atelier Berger",
"email": "noa@atelierberger.com",
"collection": "Resort 26 — 40 pieces of knitwear, shooting the week of the 12th.",
"website": "string"
}Responses
| Status | Meaning |
|---|---|
200 | The request was recorded (or already was). |
400 | Invalid body, or a disposable email domain. |
429 | Too many requests from this address. |
200 returns:
{
"status": "received"
}Call it
curl -X POST "https://api.flam.fashion/api/toolkit/invite/request" \
-H "Authorization: Bearer $FLAM_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Noa Berger","house":"Atelier Berger","email":"noa@atelierberger.com","collection":"Resort 26 — 40 pieces of knitwear, shooting the week of the 12th.","website":"string"}'