Invite a user to a WorkOS organization, accept the invitation, and manage their organization membership and RBAC role

Documented steps

1. Send an invitation: POST https://api.workos.com/user_management/invitations with 'Authorization: Bearer sk_...' and required param email. Optional: organization_id, role_slug (role granted on acceptance), expires_in_days (1-30, default 7), inviter_user_id, locale.
2. The response returns an invitation object with a token and an accept_invitation_url. WorkOS emails the invite automatically, or you can suppress that and deliver the URL yourself.
3. Inspect a pending invite with GET /user_management/invitations/{id}, or list with GET /user_management/invitations filtered by organization_id or email and paginated via limit/before/after/order.
4. When the invited user signs up through the authorize flow, pass invitation_token into the authenticate call so the invitation is consumed as part of sign-up. Alternatively call POST /user_management/invitations/{id}/accept once the user record exists.
5. On acceptance the invitation state becomes 'accepted' and the organization membership activates with the role_slug from the invitation, or the organization's default role if none was set.
6. Create a membership directly (no invitation): POST https://api.workos.com/user_management/organization_memberships with required user_id and organization_id, plus optional role_slug (defaults to 'member') OR role_slugs array — the two are mutually exclusive.
7. Change a member's role: PUT https://api.workos.com/user_management/organization_memberships/{id}.
8. Suspend access without deleting history: PUT /user_management/organization_memberships/{id}/deactivate, reverse with /reactivate, or remove permanently with DELETE /user_management/organization_memberships/{id}.
9. List memberships: GET /user_management/organization_memberships — you must supply at least one of user_id or organization_id; filter by statuses (active, inactive, pending).
10. Manage the roles available to role_slug via GET https://api.workos.com/authorization/roles or GET /authorization/roles/{slug}. Slugs must be lowercase letters, numbers, hyphens, and underscores only.
11. Revoke an unaccepted invitation: POST /user_management/invitations/{id}/revoke, which sets state to 'revoked' and populates revoked_at.
12. Reference: https://workos.com/docs/reference/authkit/invitation
13. Reference: https://workos.com/docs/reference/authkit/organization-membership
14. Reference: https://workos.com/docs/rbac/integration