Invites

GET    /api/organizations/{id}/invites
POST   /api/organizations/{id}/invites
DELETE /api/organizations/{id}/invites/{inviteId}

GET  /api/invites/{token}
POST /api/invites/{token}/accept

Admins create invites with email and role. Recipients open the token link, sign in if needed, and POST accept to join the org.