What causes "Invitation not found" in Significant-Gravitas/AutoGPT?

Verify the full token arrives intact in the URL (no truncation, no encoding damage) by logging its length at the client.

Significant-Gravitas/AutoGPT · error · NotFoundError

Invitation not found

Error message

Invitation not found

What it means

Raised by POST /api/invitations/{token}/accept when no OrgInvitation row has the given token. Tokens are single-use opaque identifiers issued at invitation creation; a missing one means the invitation was deleted, the token is malformed, or it never existed. HTTP 404 via NotFoundError.

Source

Thrown at autogpt_platform/backend/backend/api/features/orgs/invitation_routes.py:151

    )


# --- Token-based endpoints (under /api/invitations) ---


@router.post(
    "/{token}/accept",
    summary="Accept invitation",
    tags=["invitations"],
    dependencies=[Security(requires_user)],
)
async def accept_invitation(
    token: str,
    user_id: Annotated[str, Security(get_user_id)],
) -> dict:
    invitation = await prisma.orginvitation.find_unique(where={"token": token})
    if invitation is None:
        raise NotFoundError("Invitation not found")
    if invitation.acceptedAt is not None:
        raise HTTPException(400, detail="Invitation already accepted")
    if invitation.revokedAt is not None:
        raise HTTPException(400, detail="Invitation has been revoked")
    if invitation.expiresAt < datetime.now(timezone.utc):
        raise HTTPException(400, detail="Invitation has expired")

    # Verify the accepting user's email matches the invitation
    accepting_user = await prisma.user.find_unique(where={"id": user_id})
    if accepting_user is None:
        raise HTTPException(401, detail="User not found")
    if accepting_user.email.lower() != invitation.email.lower():
        raise HTTPException(
            403,
            detail="This invitation was sent to a different email address",
        )

    # Add user to org (idempotent — handles race condition from concurrent accepts)

View on GitHub (pinned to 9c8bb5550f)

Solutions

Verify the full token arrives intact in the URL (no truncation, no encoding damage) by logging its length at the client.
Look up the token directly: prisma.orginvitation.find_unique(where={'token': token}) to confirm the record exists.
If the invitation was deleted/revoked-and-purged, ask the org admin to send a fresh invitation.
Check you are hitting the same backend/environment that generated the email link.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await api.post(`/api/invitations/${token}/accept`);
} catch (e) {
  if (e.status === 404) show('This invitation link is invalid or was removed. Ask for a new one.');
  else throw e;
}

Prevention

Send full, unbroken invitation URLs in emails (avoid wrapping)
Verify tokens reach the server untruncated before assuming corruption
Ensure email links target the environment that issued them

When it happens

Trigger: User clicks an invitation link whose token was mistyped, truncated by an email client, or whose invitation record was removed. Also tokens from a different environment (test email link opened against production).

Common situations: Email client wraps/breaks long URLs; invitation deleted by an admin before acceptance; user reuses an old link after the row was purged; reverse proxy stripping path segments.

Related errors

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/7675ce1ad65e2283. Report an issue: GitHub.