curl -X POST "https://api.next.orenda.finance/v1/access-management/customer-invites" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "katherine.johnson@example.com",
"role": "CHILD",
"accountId": "8f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
"confirmation": {
"method": "totp",
"totp": "123456",
"accessToken": "eyJraWQiOiJ...your-access-token"
}
}'{
"success": true,
"message": "Customer invitation processed successfully",
"data": {
"applicationId": "d6354344-a847-49cd-9e41-530d720e7a21"
}
}Invite a sub-user or corporate manager
Invites a sub-user, who is funded from one of your accounts, or a corporate manager, who operates your company.
role says what the user becomes. It is required.
role | The user becomes | accountId |
|---|---|---|
PREPAID_CARD_CUSTOMER | A sub-user with a prepaid card, funded from your account | Required |
CARD_ONLY | A sub-user who only holds a card, funded from your account | Required |
CHILD | A sub-user who is your child | Required |
CORPORATE_MANAGER | A person who operates your company | Do not send |
You can only invite the roles your program has been given. The table lists every role this route understands, not the ones available to you. Inviting a role your program does not have returns 400. Speak to the team that manages your program to find out which roles you have.
Step-up. Send a confirmation (passkey or TOTP). If your program signs in through SSO, leave it out.
The guide, Invite a sub-user or corporate manager, explains each kind of invite, what you cannot do on this route, and how to act on each error.
curl -X POST "https://api.next.orenda.finance/v1/access-management/customer-invites" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "katherine.johnson@example.com",
"role": "CHILD",
"accountId": "8f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
"confirmation": {
"method": "totp",
"totp": "123456",
"accessToken": "eyJraWQiOiJ...your-access-token"
}
}'{
"success": true,
"message": "Customer invitation processed successfully",
"data": {
"applicationId": "d6354344-a847-49cd-9e41-530d720e7a21"
}
}Authorizations
The user's access_token from authentication. The program and environment come from the token.
Body
What a signed-in customer sends. role is required. Which of the user's details are required depends on the role and on your program; if one is missing, the 400 names it.
The user's email address. Must not already be in use in the program.
What the user becomes. PREPAID_CARD_CUSTOMER, CARD_ONLY and CHILD invite a sub-user and need accountId. CORPORATE_MANAGER invites a manager of your company. Your program must have the role. Write it exactly, in capitals with underscores.
PREPAID_CARD_CUSTOMER, CARD_ONLY, CHILD, CORPORATE_MANAGER "CHILD"
The user's first name.
The user's last name.
Date of birth, YYYY-MM-DD.
Two-letter country code, for example GB.
7 to 15 digits, with an optional + in front.
The user's address. country is a three-letter code. On some programs it is copied from your own details and can be left out.
Show child attributes
Show child attributes
The account a sub-user is funded from. Required for a sub-user. Must be one of your own accounts, ACTIVE, and not itself funded from a parent. Do not send it for CORPORATE_MANAGER.
Step-up: a passkey or a TOTP code. Leave it out only if your program signs in through SSO.
- Passkey
- TOTP
Show child attributes
Show child attributes