Members & Invitations

Membership management. These are owner operations over a user session (JWT); room API tokens cannot manage members.

List members

GET /api/rooms/:roomId/members
Authorization: Bearer <jwt>

[
  { "userId": "auth0|123456", "email": "owner@example.com", "role": "owner",  "addedAt": 1700000000000 },
  { "userId": "auth0|789012", "email": "editor@example.com", "role": "editor", "addedBy": "auth0|123456" }
]

Readable by any room member.

Invite a member

POST /api/rooms/:roomId/invite      — owner
Content-Type: application/json

{ "email": "newuser@example.com", "role": "editor" }

Valid roles: editor, viewer. If the user already exists they’re added immediately; otherwise a pending invitation is created and auto-accepted the next time they sign in.

Remove a member

DELETE /api/rooms/:roomId/members/:userId     — owner

Removes the member and drops the room from their list. The owner cannot be removed.

Pending invitations

GET    /api/rooms/:roomId/pending-invitations
DELETE /api/rooms/:roomId/pending-invitations/:email
GET    /api/users/pending-invitations          # invitations addressed to the current user
POST   /api/rooms/:roomId/accept-invitation

Use these to list and rescind a room’s outstanding invitations, and for an invitee to see and accept invitations addressed to them.