# Invite a Practitioner to the project

Canonical page: https://docs.ovok.com/api/projects/invite-a-practitioner-to-the-project

`POST /v1/projects/me/members`

Adds a Practitioner to your current project and emails them a link to set their password.

**Auth:** bearer token of a project admin (`ProjectMembership.admin`).
**Scope:** the caller's project (from the token). The project setting `PRACTITIONER_INVITATION_ENABLED` must be on.

## Behaviour

- `email` is trimmed and lowercased. `firstName` and `lastName` default to `New` and `Member`; `admin` defaults to `false`.
- Creates the User (when the address has no account yet), the Practitioner and the membership in one write.
- The invitee is emailed a link to set a password, built on the project's practitioner app URL (the project's `PRACTITIONER_APP_URL`, then the parent project's, then the legacy `CLINICIAN_DASHBOARD_URL`, then your request's `Origin` when CORS allows it, then the deployment default). The response has `pending: true` and `existingAccount: false`.
- An address that can already sign in (it has a password, or belongs to another project) gets the membership but no email, and the response has `existingAccount: true`.
- If the email cannot be sent, the new account is removed again and the request fails.
- `access` sets the membership's `access[]` entries. Each must name an AccessPolicy of this project. With `access`, the membership's base `accessPolicy` is the project's `DEFAULT_PRACTITIONER_ACCESS_POLICY` setting.
- A member with this email already exists on the project: 409. Setting `access` on a project with no default practitioner access policy: 409 `invitation_not_configured`. No practitioner app URL resolves: 409 `app_url_not_configured`, and nothing is created.
- Practitioner invitations disabled on the project: 403.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v1/projects/me/members' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "max.mustermann@example.com",
    "firstName": "Max",
    "lastName": "Mustermann",
    "admin": false
  }'
```