Team

Update invitation

Updates only the permissions of a pending invitation in the API key’s company. Requires API access Manage, Team & access Manage, RBAC enabled, and an active or trialing Growth subscription for every edit, including Admin and unchanged requests. The person must be allowed both to manage the invitation’s existing access and to grant the requested access. Accepted invitations and unavailable or foreign-company invitations return resource_missing without exposing their data.

Only access_template and custom permissions are accepted in the JSON body. Names, email, version, and other fields are rejected; query parameters do not supply body fields. Presets admin/read_only reject permissions even null. Custom requires every catalog area with none/view/manage; api_access supports only none/manage. Extra areas are rejected. Responses label custom permissions matching a preset as that preset.

Only public IDs matching ^invite_[A-Za-z0-9]+$ are accepted. Numeric IDs, UUIDs, and acceptance tokens are invalid_request. No public-ID fallback or backfill occurs. Response IDs retain their nullable contract; never substitute a private identifier. Returns the saved invitation and changed=true when permissions differ, false otherwise. Does not send email, renew expiration, or change identity or original attribution. Expired pending invitations can be edited. Version remains an opaque saved revision; do not interpret it as a token or manufacture it. Allow new response fields and treat unknown enum values as unsupported, never as additional access. An uncertain result can be retried with the same body; authorization and plan checks still apply. Access is replaced as a complete permission set, not merged as a partial update. There is no version precondition or compare-and-swap: a later authorized edit can overwrite earlier permissions. Fetch current state when needed. Resend, revoke, and accepted-member management are separate operations.

PATCH

team

invitations

{id}

Update invitation

curl --request PATCH \
  --url https://app.finta.com/api/v1/team/invitations/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "access_template": "read_only"
}
'

import requests

url = "https://app.finta.com/api/v1/team/invitations/{id}"

payload = { "access_template": "read_only" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({access_template: 'read_only'})
};

fetch('https://app.finta.com/api/v1/team/invitations/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.finta.com/api/v1/team/invitations/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'access_template' => 'read_only'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.finta.com/api/v1/team/invitations/{id}"

	payload := strings.NewReader("{\n  \"access_template\": \"read_only\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://app.finta.com/api/v1/team/invitations/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"access_template\": \"read_only\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.finta.com/api/v1/team/invitations/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"access_template\": \"read_only\"\n}"

response = http.request(request)
puts response.read_body

{
  "invitation": {
    "version": "2026-09-09T17:20:00.000000Z",
    "id": "invite_h8i9j0k1l2m3n4",
    "invited_by": "usr_a1b2c3d4e5f6g7",
    "expires": 1791568800,
    "object": "invitation",
    "email": "sam@example.com",
    "name": "Sam Rivera",
    "access_template": "admin",
    "permissions": {
      "dashboard": "none",
      "transactions": "none",
      "accounting_setup": "none",
      "reconciliation": "none",
      "invoices": "none",
      "reports": "none",
      "forecast": "none",
      "taxes": "none",
      "integrations": "none",
      "company": "none",
      "team_access": "none",
      "billing": "none",
      "ask_finta": "none",
      "api_access": "none"
    },
    "created": 1788976800
  },
  "changed": true
}

Authorizations

Authorization

string

header

required

API key prefixed with finta_

Path Parameters

string

required

Pattern: ^invite_[A-Za-z0-9]+$

Body

application/json

Option 1
Option 2

access_template

enum<string>

required

The template matching stored permissions. Admin means all areas have manage access. Read_only means view access for every area except api_access, which is none. Custom means neither template matches exactly; inspect permissions for the actual access.

Available options:

admin,

read_only

permissions

object

Stored company permissions shown on the Settings team page. All areas are always included. None means no access to the area; view means read access; manage means management access. API access supports none or manage; other areas also support view.

Show child attributes

Response

Saved invitation; changed indicates whether permissions differed.

invitation

object

required

Show child attributes

changed

boolean

required

False for a newly created invitation (201) and an unchanged replay. True when an existing invitation is renewed, its permissions change, or delivery work is requested. Not a guarantee that email arrived; use HTTP 201 to identify creation.

Update invitation

curl --request PATCH \
  --url https://app.finta.com/api/v1/team/invitations/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "access_template": "read_only"
}
'

import requests

url = "https://app.finta.com/api/v1/team/invitations/{id}"

payload = { "access_template": "read_only" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({access_template: 'read_only'})
};

fetch('https://app.finta.com/api/v1/team/invitations/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.finta.com/api/v1/team/invitations/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'access_template' => 'read_only'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.finta.com/api/v1/team/invitations/{id}"

	payload := strings.NewReader("{\n  \"access_template\": \"read_only\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://app.finta.com/api/v1/team/invitations/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"access_template\": \"read_only\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.finta.com/api/v1/team/invitations/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"access_template\": \"read_only\"\n}"

response = http.request(request)
puts response.read_body

{
  "invitation": {
    "version": "2026-09-09T17:20:00.000000Z",
    "id": "invite_h8i9j0k1l2m3n4",
    "invited_by": "usr_a1b2c3d4e5f6g7",
    "expires": 1791568800,
    "object": "invitation",
    "email": "sam@example.com",
    "name": "Sam Rivera",
    "access_template": "admin",
    "permissions": {
      "dashboard": "none",
      "transactions": "none",
      "accounting_setup": "none",
      "reconciliation": "none",
      "invoices": "none",
      "reports": "none",
      "forecast": "none",
      "taxes": "none",
      "integrations": "none",
      "company": "none",
      "team_access": "none",
      "billing": "none",
      "ask_finta": "none",
      "api_access": "none"
    },
    "created": 1788976800
  },
  "changed": true
}

API Reference

Company

Team

Categories

Departments

Integrations

Aggregations

Transactions

Journal Entries

Parties

Reports

Update invitation

Authorizations

Path Parameters

Body

Response