# Invite a User and Assign Permissions

You need to give a single user access to a specific subscription, and you don't want to set up a group for it. Instead of inviting the user and creating policies afterwards, you can include the permissions in the invitation itself. The permissions are granted automatically when the user accepts.

**Approach:** Create an invitation with predefined permissions, then track it until the user accepts.

When to use groups instead
If several users need the same access, or you expect access to change over time, [onboard them as a team](/apis/platform/iam/use-cases/onboard-team) with a group. Permissions granted through an invitation are tied to the individual user.

## Prerequisites

- An access token with `tenant.subjects.manage` on scope `/`
- `iam.policy.write` on every scope you want to grant in the invitation
- The actions and scope URIs to grant (see [Policies](/apis/platform/iam/concepts/policies))


## Step 1: Create the invitation with permissions

Example request body:


```json
{
  "email": "jane.doe@example.com",
  "permissions": [
    { "action": "banking.ais.read", "scope": "/subscriptions/123" }
  ],
  "ttlDays": 7,
  "redirectUri": "https://app.example.com/welcome"
}
```

- `permissions` lists the action and scope pairs granted when the invitation is accepted.
- `ttlDays` sets how many days the invitation stays valid.
- `redirectUri` is optional. It is where the user is sent after completing registration.


The user receives an email with a link to complete registration in Aritma ID. Note the `id` from the response so you can track the invitation.

## Step 2: Track the invitation

When the user completes registration, the status changes to `Accepted` and the permissions take effect. If the user doesn't accept within `ttlDays`, the status changes to `Expired` and no permissions are granted.

To see all invitations in your tenant, use `GetInvitations`.

## Step 3: Resend or cancel if needed

If the user didn't receive the email, or you wish to extend the TTL, resend it:

If the invitation was sent by mistake or with the wrong permissions, cancel it and create a new one:

## Next steps

- To confirm what the user can do after accepting, use [View a user's permissions](/apis/platform/iam/guides/user-management#view-a-users-permissions)
- To grant more access later, [create a policy](/apis/platform/iam/guides/policies#create-a-policy)
- To remove access when the user leaves, follow [Revoke Access for a Departed User](/apis/platform/iam/use-cases/revoke-access)