> ## Documentation Index > Fetch the complete documentation index at: https://www.finta.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Resend invitation > Resends a pending invitation using only its public ID. Send no request body or query parameters; no Content-Type header is required for the bodyless POST. Bodies (including an empty JSON object or the former version field) and query parameters are rejected with invalid_request. The backend loads the current revision from the API key's company and supplies it internally to the existing resend service. Clients do not fetch or send version, and this endpoint adds no idempotency-key support. Requires API access Manage, Team & access Manage, and permission to manage the target. Existing account, subscription, staging and usage checks apply. No additional Growth or RBAC feature gate. Only IDs matching ^invite_[A-Za-z0-9]+$ are accepted; numeric IDs, UUIDs and acceptance tokens are invalid_request. Missing, accepted and foreign-company invitations are unavailable (resource_missing). No global cross-company lookup occurs. For the current saved revision, the existing service renews the acceptance link and expiration and requests delivery. Both expired and unexpired pending invites can be resent. Original identity, permissions, created and invited_by remain unchanged. Each call reads the current state and is a fresh resend request. A repeat after a timeout can renew again and request another email, even when an earlier delivery is pending. The newer acceptance link replaces the earlier link. Do not automatically retry an uncertain result as if it were duplicate-safe; retry only when another resend is acceptable. Returns 200 with the saved invitation and changed. Normally changed=true; if the revision changes between lookup and the service's locked check, existing stale-version behavior may return changed=false. Existing matching pending-delivery retry behavior is preserved. No forced retry loop is added. Neither 200 nor changed=true guarantees email arrival. Enqueue-registration failure rolls back renewal; delivery may also fail after commit. For invitation_resend_failed, use bounded backoff only when another resend is acceptable. Response version remains an informational opaque saved revision for compatibility, not an input requirement or acceptance credential. Public IDs retain their nullable contract; no numeric fallback, request-time backfill, acceptance token or internal delivery token is exposed. Accept new response fields and handle unknown future enums without inferring additional access. An internal revision failure is invitation_resend_failed with no client version parameter to correct. ## OpenAPI ````yaml /openapi.yaml post /team/invitations/{id}/resend openapi: 3.0.3 info: title: Finta API version: '1.0' description: > The Finta API provides programmatic access to your company's financial data, including transactions, journal entries, categories, financial reports, and the team directory. ## Authentication Each API key is scoped to a single company. There is no company ID parameter. The key already knows which company it belongs to. If you have access to multiple companies, create a separate key for each. A key acts as its owner; it does not have a separate permission snapshot. The owner must currently have **API access: Manage**, plus the permission required by the endpoint: | Endpoint | Required permission | |----------|---------------------| | `GET /company` | Company: View | | `GET /team` | Team & access: View | | `DELETE /team/invitations/{id}` | Team & access: Manage; target-management limits apply. No additional Growth/RBAC gate. | | `POST /team/invitations/{id}/resend` | Team & access: Manage; target-management limits apply. No additional Growth/RBAC gate. | | `PATCH /team/invitations/{id}` | Team & access: Manage; RBAC and active/trialing Growth required, with grant and target limits. | | `POST /team/invitations` | Team & access: Manage; requested grants must also be allowed for the person and plan. | | `GET /categories`, `GET /departments` | Accounting setup: View | | `GET /integrations` | Integrations: View | | `GET /reports/*` | Reports: View | | `GET /transactions`, `GET /transactions/{id}` | Transactions: View | | `PATCH /transactions/{id}` | Transactions: Manage | | `GET /journal_entries`, `GET /aggregations/total`, `GET /parties/merchants` | Reports: View | Permission changes apply to the next request. Removing API access permanently revokes the owner's active keys for that company; restoring access requires creating a new key. Authenticate by including your API key in the `Authorization` header: ``` Authorization: Bearer finta_... ``` ### Key prefix convention Every Finta credential is prefixed so it can be recognized at a glance in logs, error messages, and secret scanners. Today there is one credential type and its prefix is `finta_`. As additional credential or token types are introduced (for example restricted keys or webhook signing secrets), each will have its own distinct prefix that stacks on the brand prefix (e.g. `finta__...`). Treat the prefix as load-bearing: do not strip it before sending, and do not assume a missing or unknown prefix is still a Finta credential. ## Rate Limits The API enforces two independent limits. Both surface as `429 Too Many Requests`, but they are distinct error codes with different retry guidance. ### Per-minute burst limit Authenticated requests are limited to **6,000 requests per 60 seconds** (100 per second) per API key. Unauthenticated requests (missing or invalid key) are limited to **120 requests per 60 seconds** per IP address. The window is **fixed**, not rolling. Each 60-second wall-clock interval is its own counter; all requests within that interval share it, and the counter resets to 0 in a single step at the next boundary. Available budget jumps from `0` back to the full bucket size (`6000` for authenticated API keys, `120` for unauthenticated IP buckets) instantaneously at the boundary, rather than aging out one slot at a time. Trust `X-RateLimit-Reset` for the exact reset timestamp. Successful responses and burst-limit rejections include the following headers. Do not assume they are present on other errors: early authentication, authorization, and monthly-limit rejections can omit them. This describes existing header behavior, not a new quota policy. | Header | Description | |--------|-------------| | `X-RateLimit-Limit` | Maximum requests per window (`6000` for authenticated requests, `120` for unauthenticated). | | `X-RateLimit-Remaining` | Requests remaining in the current window. | | `X-RateLimit-Reset` | Unix timestamp when the window resets. | On a 429 for this case, an additional header is included: | Header | Description | |--------|-------------| | `Retry-After` | Number of seconds until the next request is safe. | The error body is `type: rate_limit_error` / `code: rate_limit_exceeded`. **Retry guidance:** This case is retryable. Honor `Retry-After` as the minimum wait, then apply exponential backoff with jitter for any retries beyond the first (cap at a few minutes; abandon after a small number of attempts to avoid retry storms). Do not retry tighter than `Retry-After`. ### Monthly per-company limit Each company has a monthly cap on total API calls, independent of the per-minute burst: | Plan | Monthly cap | |------|-------------| | Formation | 10 | | Startup | 300 | | Growth | 30,000 | Counts reset at **midnight Pacific Time (US & Canada)** on the 1st of each month. This is the Finta application's configured time zone; the cap is computed in that zone, not in UTC. Consumers in other time zones should convert the local-midnight Pacific boundary to their own clock; note that the absolute UTC offset shifts by one hour twice a year for daylight saving (PST is UTC-8, PDT is UTC-7). Blocked requests are not counted toward the limit. The error body is `type: limit_error` / `code: monthly_limit_exceeded`, and the `message` field includes the reset date in human-readable form. **Retry guidance:** This case is **not retryable in the short term.** No `Retry-After` header is sent, deliberately, because the only meaningful remediation is to upgrade the plan (Settings -> Plans at app.finta.com) or wait until the 1st of the next month. Naive retry loops should branch on `error.code` and stop retrying when they see `monthly_limit_exceeded`. SDKs that auto-retry on 429 should look at `error.code` (or the absence of `Retry-After`) before re-issuing. Existing temporary user/company limit overrides may change the allowance and wording of the monthly-limit message. The error code and no-short-term-retry rule remain unchanged. ## Pagination List endpoints use cursor-based pagination. Pass `limit` to control page size (default 100, max 500). To fetch the next page, pass `starting_after` with the `next_cursor` value from the previous response. Responses include `object: "list"`, `url` (the canonical path of the collection, relative to the API host), `has_more` (whether more results exist), `next_cursor` (an opaque value to pass unchanged as `starting_after`), and `data` (the page of items). ## Amounts Every monetary field in the API follows two non-negotiable rules: 1. **Integer cents.** Monetary values are integers, never floats and never formatted strings. `$499.00` is `49900`. `$1,500.00` is `150000`. Divide by 100 to get dollars. This avoids floating-point precision errors in financial calculations. 2. **`_cents` suffix.** The field name always ends in `_cents` (e.g. `amount_cents`, `balance_cents`, `total_cents`, `net_income_cents`, `change_in_cash_cents`, `cash_cents`). If a field name does not end in `_cents`, it is not a monetary value. These rules apply to every monetary field across every endpoint (transactions, journal entries, income statement, balance sheet, cash flow). There are no exceptions and there is no "summary" or "display" sibling field that returns the same amount in dollars or as a string. If you encounter a field that appears to hold a monetary value but does not end in `_cents`, or whose value is not an integer, treat it as a bug and report it. Sign conventions: - **Income statement**: revenue/income amounts are positive, expense amounts are negative. Summing every section's `total_cents` yields net income without sign-flipping. - **Balance sheet**: `balance_cents` carries the natural-sign cumulative balance for that account at the report date. - **Cash flow**: `amount_cents` is positive for cash inflows and negative for cash outflows. ## Errors Errors return a consistent JSON structure: ```json { "error": { "type": "invalid_request_error", "code": "resource_missing", "message": "The requested resource was not found.", "doc_url": "https://www.finta.com/docs/api-reference/errors#resource_missing" } } ``` ### Status codes | Status | Meaning | |--------|---------| | `200 OK` | Request succeeded. | | `201 Created` | A new invitation was created. | | `400 Bad Request` | Request was malformed or had invalid parameters. | | `401 Unauthorized` | The bearer credential is missing, malformed, or unrecognized. The fix is to obtain a valid API key. | | `403 Forbidden` | The API key is valid, but the caller does not have permission to access the resource. The fix is to regain the required company or product-area access. See the `Forbidden` response component for the specific codes. | | `404 Not Found` | The requested resource, or the endpoint itself, does not exist. Unknown or renamed paths (for example an old hyphenated report path like `/reports/income-statement` instead of `/reports/income_statement`) return this same envelope with `type: invalid_request_error` and `code: resource_missing`, as JSON, regardless of the `Accept` header. | | `422 Unprocessable Entity` | Invitation data failed validation, for example an invalid email or a conflicting invitation or existing teammate. | | `429 Too Many Requests` | Either the per-minute burst rate limit (retryable, with `Retry-After`) or the monthly per-company API call limit (not retryable in the short term, no `Retry-After`). Branch on `error.code` to distinguish the two and avoid retry storms on monthly exhaustion. See the Rate Limits section for the full retry guidance. | | `5xx` | An unexpected error on Finta's side. Retry with exponential backoff. | The `error.type` and `error.code` fields are stable identifiers safe to switch on programmatically. The `error.message` is human-readable and may change without notice. servers: - url: https://app.finta.com/api/v1 description: Production security: - bearerAuth: [] tags: - name: Company description: Retrieve company metadata - name: Team description: Retrieve company members and manage invitations - name: Categories description: List your chart of accounts categories - name: Departments description: List the departments available to the authenticated company - name: Integrations description: List the authenticated company's integrations and their connection status - name: Aggregations description: Compute a single figure for one category and its descendants - name: Transactions description: > Transactions are what your bank shows you: a single line like "AWS charged you $499." Most API consumers want transactions. For accounting-level detail, see Journal Entries. Amounts are in cents (e.g. `amount_cents: 49900` = $499.00). - name: Journal Entries description: > Journal entries are the accounting records that transactions create. A single $499 AWS charge becomes two journal entries: debit Software $499, credit Cash $499 (double-entry bookkeeping). Use journal entries when you need accounting-level detail. Amounts are in cents (e.g. `amount_cents: 49900` = $499.00). - name: Parties description: Discover observed counterparties for category-scoped financial queries. - name: Reports description: > Financial statements: income statement, balance sheet, and cash flow. Each report returns the complete statement for a single period. You cannot filter to one category or request multiple periods in one call. paths: /team/invitations/{id}/resend: post: tags: - Team summary: Resend invitation description: > Resends a pending invitation using only its public ID. Send no request body or query parameters; no Content-Type header is required for the bodyless POST. Bodies (including an empty JSON object or the former version field) and query parameters are rejected with invalid_request. The backend loads the current revision from the API key's company and supplies it internally to the existing resend service. Clients do not fetch or send version, and this endpoint adds no idempotency-key support. Requires API access Manage, Team & access Manage, and permission to manage the target. Existing account, subscription, staging and usage checks apply. No additional Growth or RBAC feature gate. Only IDs matching ^invite_[A-Za-z0-9]+$ are accepted; numeric IDs, UUIDs and acceptance tokens are invalid_request. Missing, accepted and foreign-company invitations are unavailable (resource_missing). No global cross-company lookup occurs. For the current saved revision, the existing service renews the acceptance link and expiration and requests delivery. Both expired and unexpired pending invites can be resent. Original identity, permissions, created and invited_by remain unchanged. Each call reads the current state and is a fresh resend request. A repeat after a timeout can renew again and request another email, even when an earlier delivery is pending. The newer acceptance link replaces the earlier link. Do not automatically retry an uncertain result as if it were duplicate-safe; retry only when another resend is acceptable. Returns 200 with the saved invitation and changed. Normally changed=true; if the revision changes between lookup and the service's locked check, existing stale-version behavior may return changed=false. Existing matching pending-delivery retry behavior is preserved. No forced retry loop is added. Neither 200 nor changed=true guarantees email arrival. Enqueue-registration failure rolls back renewal; delivery may also fail after commit. For invitation_resend_failed, use bounded backoff only when another resend is acceptable. Response version remains an informational opaque saved revision for compatibility, not an input requirement or acceptance credential. Public IDs retain their nullable contract; no numeric fallback, request-time backfill, acceptance token or internal delivery token is exposed. Accept new response fields and handle unknown future enums without inferring additional access. An internal revision failure is invitation_resend_failed with no client version parameter to correct. operationId: resendTeamInvitation parameters: - name: id in: path required: true schema: type: string pattern: ^invite_[A-Za-z0-9]+$ responses: '200': description: >- Saved invitation; changed is normally true for renewal/delivery work and may be false if the revision changes concurrently. Email arrival is not guaranteed. content: application/json: schema: $ref: '#/components/schemas/InvitationOperation' '400': description: >- Request body or query parameters supplied, or invalid public ID (invalid_request). content: application/json: schema: $ref: '#/components/schemas/Error' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- Existing API access/account checks failed or target access exceeds the caller (insufficient_permission). Resend adds no Growth or RBAC gate. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: >- The team or invitation is unavailable, including missing, accepted and foreign-company invitations (resource_missing). content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: >- Stored invitation validation failed (invitation_invalid). Resolve the record condition through another supported workflow; resend accepts no body and cannot repair identity or permissions. content: application/json: schema: $ref: '#/components/schemas/Error' '429': $ref: '#/components/responses/RateLimited' '500': description: >- Resend failed (invitation_resend_failed). Retry with bounded backoff only if another resend is acceptable; repeated calls may renew again and request another email. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: InvitationOperation: type: object additionalProperties: false required: - invitation - changed properties: invitation: $ref: '#/components/schemas/Invitation' changed: type: boolean description: >- False for a newly created invitation (201) and an unchanged replay. True when an existing invitation is renewed, its permissions change, or delivery work is requested. Not a guarantee that email arrived; use HTTP 201 to identify creation. Error: type: object required: - error properties: error: type: object required: - type - code - message - doc_url properties: type: type: string enum: - authentication_error - permission_error - invalid_request_error - rate_limit_error - limit_error - api_error description: >- The error category. `authentication_error` (401) means the bearer credential was missing, malformed, or unrecognized. `permission_error` (403) means the credential was valid but the caller is not allowed to access the resource. `invalid_request_error` covers invalid parameters, unavailable resources, and invitation validation failures. `rate_limit_error` is for per-minute burst limits (retry shortly). `limit_error` is for monthly API call limits per company (upgrade or wait for reset). `api_error` denotes an operation failure on the server (500); retry the same invitation body with exponential backoff. code: type: string enum: - invalid_api_key - user_inactive - user_removed_from_company - company_closed - subscription_required - staging_access_denied - insufficient_permission - resource_missing - parameter_missing - category_update_failed - transaction_update_failed - rate_limit_exceeded - monthly_limit_exceeded - invalid_date_range - invalid_date - invalid_request - plan_upgrade_required - feature_disabled - invitation_invalid - invitation_create_failed - permissions_update_failed - invitation_resend_failed - invitation_revoke_failed description: A specific error code. message: type: string description: A human-readable description of the error. doc_url: type: string format: uri description: A link to documentation about this error. example: https://www.finta.com/docs/api-reference/errors#invalid_api_key param: type: string nullable: true description: The parameter that caused the error, if applicable. Invitation: type: object additionalProperties: false required: - id - object - email - name - access_template - permissions - created - invited_by - expires - version properties: version: type: string description: >- Informational opaque revision of the saved invitation, also returned by GET /team. Resend loads the current revision internally and requires no version input. This is not an acceptance credential. Delivery completion alone does not change this revision. example: '2026-09-09T17:20:00.000000Z' id: type: string pattern: ^invite_[A-Za-z0-9]+$ nullable: true description: >- Public invitation identifier, or null when unavailable. UUIDs, numeric IDs, and secret acceptance tokens are never returned. example: invite_h8i9j0k1l2m3n4 invited_by: type: string pattern: ^usr_[A-Za-z0-9]+$ nullable: true description: >- Public user ID of the original inviter, or null when unavailable. Preserved when another user resends the invitation or the inviter becomes inactive. The inviter may no longer appear in members. UUIDs and numeric IDs are never returned. example: usr_a1b2c3d4e5f6g7 expires: type: integer description: >- Unix timestamp in seconds of the current acceptance deadline. An invitation is expired when this value is at or before the current time. Pending invitations can be expired; resending extends this deadline without changing created or invited_by. example: 1791568800 object: type: string enum: - invitation email: type: string example: sam@example.com name: type: string nullable: true description: >- The invitee's stored first and last names with surrounding whitespace trimmed, joined with a space using whichever parts are present. Null when both are blank; never derived from email. example: Sam Rivera access_template: $ref: '#/components/schemas/TeamAccessTemplate' permissions: $ref: '#/components/schemas/TeamPermissions' created: type: integer description: >- Unix timestamp when the invitation was created. Resending does not change this value. example: 1788976800 TeamAccessTemplate: type: string enum: - admin - read_only - custom description: >- The template matching stored permissions. Admin means all areas have manage access. Read_only means view access for every area except api_access, which is none. Custom means neither template matches exactly; inspect permissions for the actual access. TeamPermissions: type: object additionalProperties: false description: >- Stored company permissions shown on the Settings team page. All areas are always included. None means no access to the area; view means read access; manage means management access. API access supports none or manage; other areas also support view. required: - dashboard - transactions - accounting_setup - reconciliation - invoices - reports - forecast - taxes - integrations - company - team_access - billing - ask_finta - api_access properties: dashboard: type: string enum: - none - view - manage transactions: type: string enum: - none - view - manage accounting_setup: type: string enum: - none - view - manage reconciliation: type: string enum: - none - view - manage invoices: type: string enum: - none - view - manage reports: type: string enum: - none - view - manage forecast: type: string enum: - none - view - manage taxes: type: string enum: - none - view - manage integrations: type: string enum: - none - view - manage company: type: string enum: - none - view - manage team_access: type: string enum: - none - view - manage billing: type: string enum: - none - view - manage ask_finta: type: string enum: - none - view - manage api_access: type: string enum: - none - manage responses: Unauthorized: description: >- Authentication failed. Returned when the bearer credential itself is missing, malformed, or unrecognized. The consumer should obtain a valid API key and retry. This is distinct from `403 Forbidden`, which is returned when the credential is valid but the caller is not allowed to access the resource. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: authentication_error code: invalid_api_key message: >- Invalid API key provided. Check that your API key is correct and active. doc_url: https://www.finta.com/docs/api-reference/errors#invalid_api_key RateLimited: description: >- Too many requests. Two distinct limits can trigger a 429: (1) Per-minute burst limit (6,000 requests per 60 seconds per API key) returns `rate_limit_error` / `rate_limit_exceeded` with `Retry-After` header. (2) Monthly API call limit per company returns `limit_error` / `monthly_limit_exceeded` with the reset date in the message. Monthly limits vary by plan: Formation (10/month), Startup (300/month), Growth (30,000/month). Blocked requests do not count toward the limit. headers: Retry-After: schema: type: integer description: >- Seconds until the burst rate limit resets. Only present for rate_limit_error responses. X-RateLimit-Limit: schema: type: integer description: >- Maximum requests per burst window. Only present for rate_limit_error responses. X-RateLimit-Remaining: schema: type: integer description: >- Requests remaining in burst window (0 when rate limited). Only present for rate_limit_error responses. X-RateLimit-Reset: schema: type: integer description: >- Unix timestamp when the burst window resets. Only present for rate_limit_error responses. content: application/json: schema: $ref: '#/components/schemas/Error' examples: burst_rate_limit: summary: Per-minute burst rate limit exceeded value: error: type: rate_limit_error code: rate_limit_exceeded message: >- Too many requests. Please retry after the Retry-After period. doc_url: >- https://www.finta.com/docs/api-reference/errors#rate_limit_exceeded monthly_limit: summary: Monthly API call limit exceeded value: error: type: limit_error code: monthly_limit_exceeded message: >- Monthly API limit reached. Your plan allows 300 calls per company per month. Resets on April 1, 2026. Upgrade in Settings -> Plans at app.finta.com. doc_url: >- https://www.finta.com/docs/api-reference/errors#monthly_limit_exceeded securitySchemes: bearerAuth: type: http scheme: bearer description: API key prefixed with `finta_` ````