Back to API Practice

Security/Auth trainer

Invite User API Practice

Practice invite creation, role assignment, duplicate invites, tenant boundaries, invite token expiry, email delivery, acceptance, and auditability.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/workspaces/invites request, inspect the fake response, and turn it into test ideas.

No real invites or emails are sent. This is a client-side simulator with placeholder users and tokens.

Request

Build the request

POST/api/workspaces/invites

Request JSON

application/json
{
  "email": "new.member@example.com",
  "role": "member",
  "workspaceId": "wrk_123"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Validation

Permissions

Security

Duplicates

Token lifecycle

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List valid invite, invalid email, missing permission, invalid role, duplicate invite, existing member, expired token, accept invite, tenant isolation, role escalation, email outage, audit logs, and metrics.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Invite User endpoint

Invite a user into a workspace with role assignment, tenant boundaries, token lifecycle, email delivery, and audit trails.

Endpoint

POST/api/workspaces/invites

Purpose

Invite a user into a workspace with role assignment, tenant boundaries, token lifecycle, email delivery, and audit trails.

Request fields

  • email: invitee email, required
  • role: target role, required
  • workspaceId: target workspace
  • message: optional invite note

Success response

201 Created

Request body

{
  "email": "new.member@example.com",
  "role": "member",
  "workspaceId": "wrk_123"
}

Example response body

{
  "inviteId": "inv_123",
  "email": "new.member@example.com",
  "role": "member",
  "status": "pending"
}

Errors

  • 400 validation error
  • 401 unauthenticated
  • 403 missing permission or tenant mismatch
  • 409 duplicate invite or existing member
  • 410 expired invite token
  • 503 email/invite store unavailable

Security notes

  • Admin/owner role escalation is blocked
  • Invite tokens are single-use and never logged
  • Cross-tenant invites are denied
  • Existing membership is not leaked unnecessarily

Business rules

  • Invite email is delivered to the invitee
  • Acceptance creates or links membership
  • Duplicate invite behavior follows product rules
  • Role assignment is server-side validated
  • Invite revoke/resend events are audited