# Invite practitioner

Canonical page: https://docs.ovok.com/api/slim/invite/invite-practitioner

`POST /v1/slim/invite/practitioner`

Invites a practitioner to your project, or to one of its direct child projects, and emails them a link to set their password.

**Auth:** Bearer token for a practitioner, project admin or System Owner session. The caller's access policy must grant `Practitioner:create` (a project admin who holds no access policy skips this check).
**Scope:** The caller's project (from the token), or `projectId` when given. `projectId` must be the caller's project or a direct child of it.

## Behaviour

- Practitioner invitations must be enabled on the target project. They are enabled unless the project turns them off.
- `accessPolicyId` must name a policy of your project, its parent or a direct child, at or below your own rank. It is checked before anything is written.
- An existing practitioner account with this `email` in the target project is refused: an invite never changes a member's role or admin flag (use `PUT /v1/slim/policy/{id}`). An existing practitioner account elsewhere, your own project included, is reused: only the membership and practitioner profile are new. A patient account of another project is not: it is that project's own, and the invitee gets a practitioner account of their own.
- Ovok creates the membership with the access policy and the practitioner profile, then emails an invitation with a password-setup link. The link points to the app the request came from, and sets a password for 7 days after it was sent. If the email fails, the account is undone and the request answers 400.
- `admin` in the body is ignored. The invitee becomes an admin member, and the project owner, only when the target project has no owner yet.
- The invitee shows as `Pending` in user lists until they set a password.
- Returns the new membership, the practitioner profile and `status: "Pending"`.


## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v1/slim/invite/practitioner' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "max.mustermann@example.com",
    "name": "Max",
    "surname": "Mustermann",
    "accessPolicyId": "c3499c27-2973-0a7f-807e-fb8676a92dcb"
  }'
```