Dashboard invite
Admin-driven invite flow that sends an email and creates the identity row when the recipient sets their password.
Two invite surfaces
Two invite surfaces
The dashboard exposes two distinct invite paths. They share an email ceremony and a one-time accept link, but they land in different layers of the identity model and bundle different things at acceptance.
Using the Dashboard
Access Control > Identities is the Environment-scoped page where invitations and role assignments are managed. The page header offers three entry points. Invite sends an email-only invite with no roles attached. Invite & Assign — covered on this page — opens a dialog that pairs the invite with a role assignment in a single step. Create Identity skips the email entirely and writes the identity row immediately; see the Dashboard create page for that flow.
Invite an identity
invite_redirect_url so the recipient lands on your branded accept page. When left blank, the link goes to Canopy's hosted /app/identity/accept-invite fallback.Other entry points
First time setting up?
When you land on a fresh Environment — the dashboard seeds every Account with a Development and Production env at signup, both empty — the Overview page shows a banner that reads "You haven't invited any users or assigned them roles yet." Click Complete Invite & Assign Users Setup to open the Setup Guide on its Invite & Assign Users tab — an interactive slide-out panel that walks you through inviting identities and assigning them roles. Each step links directly to the right page and surfaces contextual help alongside, so you don't have to bounce between docs and the dashboard to figure out where to click next.
What the guide walks you through:
What the recipient sees
Once you click Send Invite, the recipient receives an email built from the configured template — a generic subject line, a greeting that includes the Account's name when available, and a primary call-to-action button.
Their flow
invite_redirect_url when an Application was selected, or Canopy's hosted /app/identity/accept-invite page when not.pending to accepted.Invites expire after 7 days. Expired invites can be resent from the dashboard to issue a fresh token with a new 7-day window.
Managing pending invites
Open Identities → Directory from the left nav and switch to the Invites tab to see every invitation that hasn't been accepted yet, plus history for accepted, expired, and revoked ones. Click any row to open its detail drawer.
From the invite drawer
If you need to re-invite someone whose original invite expired or was revoked, just send a brand-new invite — the old row stays in history and the new one is independent.
Using the API
You can also invite identities through the API instead of using the dashboard. Use this when you're provisioning users in bulk, syncing from an HR or directory system, or wiring sign-up into a self-service flow on your own site. Each API key is scoped to one Environment — POST /api/v1/identity-invites creates the invitation, and any role + node attached to it, in that Environment and nowhere else.
Endpoint
POST /api/v1/identity-invitesAuthenticate with your API key in the X-API-Key header.
Example
Send the recipient's email, first name, and last name, with an optional initial role and node, in the request body:
{
"email": "regional.manager@example.com",
"first_name": "Pat",
"last_name": "Lee",
"role_id": "5e1f2a3b-4c5d-4e6f-7a8b-9c0d1e2f3a4b",
"node_id": "0aa1b2c3-d4e5-4f6a-7b8c-9d0e1f2a3b4c"
}The response returns the created invitation with its id and an accept_url. Until the recipient accepts, the identity is in the pending state and the pre-attached assignment is dormant. Once accepted, the identity flips to active and the assignment takes effect immediately. For mass invitations, the same surface exposes POST /api/v1/identity-invites/bulk-create for up to 200 invites per call with per-row partial-success semantics.