Validate an invite code and create the user account
POST/api/v1/invites/:inviteId/challenges/:challengeId/validate
Public endpoint (no auth). On success creates the local user account, converts all pending invites for that email into bucket memberships, and issues full access/refresh cookies.
Request
Responses
- 204
- 401
- 403
- 404
- 409
- 410
Account created; auth cookies issued
Response Headers
Set-Cookie
Sets safebucket_access_token and safebucket_refresh_token cookies (HttpOnly, SameSite=Lax, Secure when TLS is enabled).
Wrong code (WRONG_CODE)
Local auth provider not enabled, or challenge locked (FORBIDDEN, CHALLENGE_LOCKED)
Challenge not found (CHALLENGE_NOT_FOUND)
A user with this email already exists (USER_ALREADY_EXISTS)
Challenge expired (CHALLENGE_EXPIRED)