Invitation Create

Customers with the explicit invitation action in a role for the calling product and an active tenant membership may invite through a trusted service. X-BES-Operator is required; invited_by is derived from it and, if supplied, must match. Targets normalize email to lowercase; other namespaces retain case. A same-tenant pending target returns the existing invitation, without a new token. Expiry is at most 48 hours after creation. Optional project must belong to tenant; optional active preset/tenant role must have a current entitlement. Control commits an encrypted invitation delivery intent and submits the link to Messaging through the identity transaction channel. The response never contains the token. Management supplies display_name and login_name at creation. Missing display_name defaults to the target address; missing login_name generates a unique BES username. The verified email becomes an alternative login address after acceptance. Creation reserves an unverified channel and a login-disabled person referenced by invited_person_id. Acceptance only confirms the organization and role, verifies the reserved address, joins membership, grants the role, and issues password setup. Legacy pending invitations without invited_person_id must be revoked and recreated.

POST /internal/control/v1/invitations