Spend an invitation link: set the account's first password and make it ACTIVE, and link it to
the person behind any other account its address already names.
Callable without a token, because the person accepting has no account yet. The link is the credential — single use, one week, stored as a sha256. No session is issued: choosing a password and proving you know it are two different claims.
Headers
Preference
params=single-object Body
Spend an invitation link: set the account's first password and make it ACTIVE, and link it to the person behind any other account its address already names.
Callable without a token, because the person accepting has no account yet. The link is the credential — single use, one week, stored as a sha256. No session is issued: choosing a password and proving you know it are two different claims.
Response
OK

