# Create accept

URL: https://docs.hanzo.ai/docs/openapi/iam/post-iam-invitations-accept

> Joins the caller to an organization through an invitation, for a person who already has an account.

`POST /v1/iam/invitations/accept`

> [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                  |
| ------------- | ------------------------------------------------ |
| **Address**   | `https://api.hanzo.ai/v1/iam/invitations/accept` |
| **Method**    | `POST`                                           |
| **Operation** | `post_iam_invitations_accept`                    |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`           |

Joins the caller to an organization through an invitation, for
a person who already has an account. Signing up through the invitation is the
other way in (signupHandler); this one spends the same seat under the same rules.

Only the caller joins, as a member and never more; the request names nobody
else. An invitation pinned to an address admits only the account holding that
address, and only with a code IAM sent to it for this join — the account's own
verified flag is not enough, because a tenant's identity provider can set it. An
invitation pinned to a phone number or a username admits no other org's account
this way. Joining an org the caller already belongs to succeeds and spends
nothing. Every refusal is recorded, and an account refused acceptLimit times in
acceptWindow is refused before anything is looked at.

## Request

7 fields, body `application/json` (required).

| Field            | In     | Type   | Required | Description |
| ---------------- | ------ | ------ | -------- | ----------- |
| `Cookie`         | header | string | —        |             |
| `Authorization`  | header | string | —        |             |
| `Sec-Fetch-Site` | header | string | —        |             |
| `Content-Type`   | header | string | —        |             |
| `code`           | body   | string | —        |             |
| `emailCode`      | body   | string | —        |             |
| `owner`          | body   | string | —        |             |

## Response

| Status    | Body            | Meaning             |
| --------- | --------------- | ------------------- |
| `200`     | iam.Answer      | ok                  |
| `400`     | iam.Answer      | bad request         |
| `403`     | iam.Answer      | forbidden           |
| `429`     | iam.Answer      | too many requests   |
| `502`     | iam.Answer      | bad gateway         |
| `503`     | iam.Answer      | service unavailable |
| `default` | problem-details | refused             |

`200` body — 8 fields.

| Field    | In   | Type   | Always | Description |
| -------- | ---- | ------ | ------ | ----------- |
| `code`   | body | string | —      |             |
| `data`   | body | any    | —      |             |
| `data2`  | body | any    | —      |             |
| `data3`  | body | any    | —      |             |
| `msg`    | body | string | —      |             |
| `name`   | body | string | —      |             |
| `status` | body | string | —      |             |
| `sub`    | body | string | —      |             |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

`hanzo` has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.

**SDK**

**.ts**

```ts
import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postIamInvitationsAccept({ code: "<code>", emailCode: "<emailCode>" });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).post_iam_invitations_accept(code="<code>", email_code="<emailCode>")
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.IamAPI.PostIamInvitationsAccept(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::post_iam_invitations_accept(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new IamApi(client).postIamInvitationsAccept();
```

**HTTP**

```bash
curl -X POST https://api.hanzo.ai/v1/iam/invitations/accept \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "code": "<code>",
       "emailCode": "<emailCode>"
     }'
```

**MCP**

MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_iam_applications"
         }
       }
     }'
```

---

[IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)