# Accept a practitioner's care invite

Canonical page: https://docs.ovok.com/api/invites/accept-a-practitioner-s-care-invite

`POST /v1/invites/care/accept`

The signed-in patient accepts a practitioner's invite into their care from a `PATIENT_ASSIGNMENT_REQUEST` email. From then on their whole record is shared with the inviting practitioner.

**Auth:** bearer token of a Patient.
**Scope:** the caller's project (from the token).

## Behaviour

- Send the `invite` and `code` values from the email's accept link as `inviteId` and `code`.
- Gates: practitioner sharing must be on for the project, and `PATIENT_INVITATION_ENABLED` must not be `false`.
- Only the patient the invite names can accept it. The invite is single use and expires 7 days after it was sent.
- On success the invite's Consent becomes `active` and a grant for the caller's record is added to the practitioner's membership, in one atomic write. The practitioner's cached sessions are refreshed.
- The practitioner gets the access described on `POST /v1/invites/record-share/accept`: the patient's whole compartment, with no delete.
- The share lasts until the patient ends it (`DELETE /v1/patient-sharing/shares/{consentId}`).
- A 409 with `practitioner_without_access_policy` means the practitioner has full project access, which a share would narrow.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v1/invites/care/accept' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \
  -H 'Content-Type: application/json' \
  -d '{
    "inviteId": "c3499c27-2973-0a7f-807e-fb8676a92dcb",
    "code": "<code from the accept link>"
  }'
```