# Creates an invitation for a new user. An invitation email is sent with a link to complete registration.
For each requested permission, the caller must have "iam.policy.write" over the requested scope.

Required IAM actions (all required, on scope /): tenant.subjects.manage

Endpoint: POST /v1/invitations
Version: 1
Security: authorization_code_with_pkce, client_credentials

## Request fields (application/json):

  - `email` (string, required)
    Email address to invite.
    Example: "jane.doe@example.com"

  - `permissions` (array, required)
    IAM permissions to grant when the invitation is accepted.

  - `permissions.action` (string, required)
    IAM action, e.g. "tenant.subjects.manage".

  - `permissions.scope` (string, required)
    Resource URI scope the action applies to.

  - `ttlDays` (integer, required)
    Number of days until the invitation expires. Defaults to 7.

  - `redirectUri` (string,null)
    URI to redirect the invitee to after they finish registering. Null means no redirect.

## Response 201 fields (application/json):

  - `id` (string, required)

  - `email` (string, required)

  - `status` (string, required)
    Enum: "Pending", "PendingEnrollment", "Processing", "Accepted", "Cancelled", "Expired"

  - `createdAt` (string, required)

  - `expiresAt` (string, required)

  - `acceptedAt` (string,null)

  - `permissions` (array, required)

  - `permissions.action` (string, required)

  - `permissions.scope` (string, required)

  - `redirectUri` (string,null)

  - `inviterName` (string,null)


## Response 401 fields

## Response 403 fields