# Team

Company members, their roles and permissions, and invites. Each member
has an own API key limited to their permissions.

 - [GET /auth/invites/{token}](https://b2b-app.lumowallet.io/apis/team/previewinvite.md): Public. Shows where the invite leads. Answers `200` for accepted and expired invites too — check `status`. `404` only for an unknown token.
 - [POST /auth/invites/{token}/accept](https://b2b-app.lumowallet.io/apis/team/acceptinvite.md): Public. Creates a member with the given email and password in the invite's company and logs them in: returns a session token and the new member's API key. If the invite names an email, only that email
 - [GET /members](https://b2b-app.lumowallet.io/apis/team/listmembers.md): Requires `members.read`.
 - [PATCH /members/{userId}](https://b2b-app.lumowallet.io/apis/team/updatemember.md): Requires `members.role.write`. `permissions`, when passed, replaces the member's list entirely. You cannot change your own role (`CANNOT_CHANGE_OWN_ROLE`), and only an owner can change an owner (`ROLE
 - [DELETE /members/{userId}](https://b2b-app.lumowallet.io/apis/team/removemember.md): Requires `members.remove`. The member's API key stops working immediately. The last owner cannot be removed, and an owner cannot remove themselves. Not available with a legacy company-wide key.
 - [GET /members/invites](https://b2b-app.lumowallet.io/apis/team/listinvites.md): Not yet accepted and not expired invites. Requires `members.read`.
 - [POST /members/invites](https://b2b-app.lumowallet.io/apis/team/createinvite.md): Requires `members.invite`. The invite is valid for 7 days; share its `url` with the new member. The invite may carry any permissions, so grant `members.invite` only to trusted members. Not available w
 - [DELETE /members/invites/{id}](https://b2b-app.lumowallet.io/apis/team/revokeinvite.md): Requires `members.invite`. An accepted invite cannot be revoked (`INVITE_USED`).