Significant-Gravitas/AutoGPT · warning · HTTPException

Invitation has been revoked

Error message

Invitation has been revoked

What it means

Raised by POST /api/invitations/{token}/accept when the invitation's revokedAt timestamp is set — an admin revoked the invitation before it was accepted. Revocation is a soft-delete; the row stays so this explicit 400 is returned instead of a bare 404. HTTP 400.

Source

Thrown at autogpt_platform/backend/backend/api/features/orgs/invitation_routes.py:155

@router.post(
    "/{token}/accept",
    summary="Accept invitation",
    tags=["invitations"],
    dependencies=[Security(requires_user)],
)
async def accept_invitation(
    token: str,
    user_id: Annotated[str, Security(get_user_id)],
) -> dict:
    invitation = await prisma.orginvitation.find_unique(where={"token": token})
    if invitation is None:
        raise NotFoundError("Invitation not found")
    if invitation.acceptedAt is not None:
        raise HTTPException(400, detail="Invitation already accepted")
    if invitation.revokedAt is not None:
        raise HTTPException(400, detail="Invitation has been revoked")
    if invitation.expiresAt < datetime.now(timezone.utc):
        raise HTTPException(400, detail="Invitation has expired")

    # Verify the accepting user's email matches the invitation
    accepting_user = await prisma.user.find_unique(where={"id": user_id})
    if accepting_user is None:
        raise HTTPException(401, detail="User not found")
    if accepting_user.email.lower() != invitation.email.lower():
        raise HTTPException(
            403,
            detail="This invitation was sent to a different email address",
        )

    # Add user to org (idempotent — handles race condition from concurrent accepts)
    try:
        await org_db.add_org_member(
            org_id=invitation.orgId,
            user_id=user_id,

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Surface a clear 'invitation revoked, contact the org admin' message to the user.
2. Admin: create a new invitation if membership is still desired — revoked tokens cannot be reactivated.
3. Do not retry the accept; the state is terminal until a new invitation is issued.

try {
  await api.post(`/api/invitations/${token}/accept`);
} catch (e) {
  if (e.status === 400 && e.detail === 'Invitation has been revoked') {
    show('This invitation was revoked. Contact the organization admin.'); return;
  }
  throw e;
}

When it happens

Trigger: Admin clicks Revoke while the invitee still holds the email link; invitee accepts an invitation that was revoked earlier (e.g., sent to the wrong address).

Common situations: Race between admin cleanup and user acceptance; stale email links after an admin reorganized memberships; revoked invitations whose emails were already delivered.

Related errors

• Invitation already revoked
• Invitation already accepted
• Teams not found in this organization: {invalid}
• Invitation has expired
• start and end query params are required

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/bd6209fd4063ffc4. Report an issue: GitHub.