Invited users management

Manage users in your Brevo profile. This guide helps profile owners manage users, edit invited users’ access permissions, and delete users via the API endpoints below.

Get all invited users

Retrieve your invited users by sending a GET request to https://api.brevo.com/v3/organization/invited/users. Sample cURL request:

1 curl --request GET \
2      --url https://api.brevo.com/v3/organization/invited/users \
3      --header 'accept: application/json' \
4      --header 'api-key: '

This GET endpoint takes no parameters — your API key alone is enough to retrieve a JSON response listing the users invited to your account. Response codes:

Response code	Message	Description
`200`	List of all users	Returns invited users, their status, the features they use, and other details.
`400`	Bad request	Returned for `invalid_parameters` or `missing_parameters`.

Sample JSON response with all users and their details, including owners and invited users:

1 {
2   "users": [
3     {
4       "email": "owner@company.com",
5       "is_owner": true,
6       "status": "active",
7       "feature_access": {
8         "marketing": "owner",
9         "conversations": "owner",
10         "crm": "owner"
11       }
12     },
13     {
14       "email": "pendingInvitedUser@company.com",
15       "is_owner": false,
16       "status": "pending",
17       "feature_access": {
18         "marketing": "custom",
19         "conversations": "none",
20         "crm": "full"
21       }
22     },
23     {
24       "email": "connectedInvitedUser@company.com",
25       "is_owner": false,
26       "status": "active",
27       "feature_access": {
28         "marketing": "none",
29         "conversations": "full",
30         "crm": "none"
31       }
32     }
33   ]
34 }

Get users permissions

Send a GET request to https://api.brevo.com/v3/organization/user/{email}/permissions to retrieve an invited user’s permissions. Sample cURL request:

1 curl --request GET \
2      --url https://api.brevo.com/v3/organization/user/example%40brevo.com/permissions \
3      --header 'accept: application/json' \
4      --header 'api-key: '

The only parameter is email:

Attribute	Datatype	Description	Value
`email`	String	Email for the invited user	example@email.com

On success, the response lists the features and permissions for the invited user. Sample 200 response:

1 {
2   "email": "invitedUser@company.com",
3   "status": "active",
4   "privileges": [
5     {
6       "feature": "Email campaign",
7       "permissions": [
8         "Create / edit / delete",
9         "Send / schedule / suspend"
10       ]
11     },
12     {
13       "feature": "Templates",
14       "permissions": [
15         "Create / edit / delete",
16         "Activate / deactivate"
17       ]
18     },
19     {
20       "feature": "SMS campaign",
21       "permissions": [
22         "Create / edit / delete",
23         "Send / schedule / suspend"
24       ]
25     },
26     {
27       "feature": "Facebook Ads",
28       "permissions": [
29         "Schedule / pause"
30       ]
31     },
32     {
33       "feature": "Landing pages",
34       "permissions": [
35         "All"
36       ]
37     },
38     {
39       "feature": "Workflows",
40       "permissions": [
41         "Create / edit / delete",
42         "Activate / deactivate / Pause"
43       ]
44     },
45     {
46       "feature": "Contacts",
47       "permissions": [
48         "View",
49         "Contact forms"
50       ]
51     },
52     {
53       "feature": "API keys",
54       "permissions": [
55         "All"
56       ]
57     },
58     {
59       "feature": "User management",
60       "permissions": [
61         "None"
62       ]
63     },
64     {
65       "feature": "Sales Platform",
66       "permissions": [
67         "All"
68       ]
69     },
70     {
71       "feature": "Conversations",
72       "permissions": [
73         "None"
74       ]
75     }
76   ]
77 }

Sample 400 bad request response:

1 {
2   "code": "method_not_allowed",
3   "message": "POST Method is not allowed on this path"
4 }

Response codes:

Response code	Message	Description
`200`	Success	The JSON response includes the user’s email, account status, and privileges.
`400`	Bad request	Incorrect parameters — for example, an invalid email format, or the account does not support inviting users.

Resend / Cancel Invitation

Send a PUT request to https://api.brevo.com/v3/organization/user/invitation/{action}/{email} to resend, cancel, or revoke an invited user’s access. The two parameters:

Attribute	Datatype	Description	Value
`action`	String	The action to be performed on the invited user	`resend`, `cancel`
`email`	String	Email of the invited user	`example@brevo.com`

On success, the response shows an OK status. Sample 200 response:

1 {
2   "status": "OK",
3   "credit_notes": [
4     "TEST-123"
5   ]
6 }

If you lack permission to change the user’s access rights, you receive a 403. Sample error response:

1 {
2   "message": "string",
3   "developer_message": "string"
4 }

Response codes:

Response codes	Message	Description
`200`	Success	The `PUT` request succeeded and access rights were updated.
`403`	Unauthorized access	You do not have permission to resend or cancel an invitation.

Revoke a user’s permission

Revoke an invited user’s access by sending a PUT request to https://api.brevo.com/v3/organization/user/invitation/revoke/{email}. Sample cURL request:

1 curl --request PUT \
2      --url https://api.brevo.com/v3/organization/user/invitation/revoke/revokeduser%40email.com \
3      --header 'accept: application/json' \
4      --header 'api-key: '

The only attribute is email:

Attribute	Datatype	Description	Value
`example`	String	Email of the user whose access is to be revoked	`revokeduser@email.com`

On success, the JSON response includes a 200 or 403 response code:

Response code	Message	Description
`200`	Credit note exists	User’s access to the account was revoked.
`403`	Unauthorized access	You are not authorized to revoke access for any user.

Sample JSON response:

1 {
2   "status": "OK",
3   "credit_notes": [
4     "TEST-123"
5   ]
6 }

Send an invitation to the user

Invite a user by sending a POST request to https://api.brevo.com/v3/organization/user/invitation/send. The user receives an email to join your account and access selected features. Sample cURL request:

1 curl --request POST \
2      --url https://api.brevo.com/v3/organization/user/invitation/send \
3      --header 'accept: application/json' \
4      --header 'api-key: ' \
5      --header 'content-type: application/json' \
6      --data '
7 {
8   "all_features_access": false,
9   "email": "inviteuser@example.com",
10   "privileges": [
11     {
12       "feature": "sms_campaigns",
13       "permissions": [
14         "view",
15         "create_edit_delete"
16       ]
17     },
18     {
19       "feature": "transactional_emails",
20       "permissions": [
21         "activate_deactivate",
22         "settings"
23       ]
24     }
25   ]
26 }

See the API reference for full parameter details. The invitation parameters:

Attribute	Datatype	Description	Value
`email`	String	Email of the invited user	example@brevo.com
`all_features_access`	Boolean	Describes if all the features can be accessed by the user or not	true or false
`privileges`	Object	Object showing the features for the user and its permissions	`feature`, `permissions`

features and permissions have predefined values to choose from. The privileges object attributes:

Attribute	Datatype	Description	Value
`features`	String	The features offered from Brevo	Some of the features are `landing_pages`, `api-keys`, `sales_platform`, `user_management` and `phone`
`permissions`	String	Permissions for the features	Some of the permissions are`all` or `send_schedule_suspend` or `create_edit_delete`

Response codes:

Response code	Message	Description
`200`	`{ "status": "ok" }`	Invitation sent successfully.
`400`	`invalid_invitation_request`	Invitation request is invalid — for example, an unsupported plan, or the user limit has been reached.
`403`	`access_denied`	Access denied to invite users.

Sample JSON response:

1 {
2   "status": "OK",
3   "credit_notes": [
4     "TEST-123"
5   ],
6   "invoice_id": "string"
7 }

Update users permissions

Update an invited user’s permissions by sending a POST request to https://api.brevo.com/v3/organization/user/update/permissions. Sample cURL request:

1 curl --request POST \
2      --url https://api.brevo.com/v3/organization/user/update/permissions \
3      --header 'accept: application/json' \
4      --header 'api-key: ' \
5      --header 'content-type: application/json' \
6      --data '
7 {
8   "all_features_access": true,
9   "email": "inviteuser@example.com"
10 }
11 '

See the API reference for full parameter details. The parameters mirror those for sending an invitation:

Attribute	Datatype	Description	Value
`email`	String	Email of the invited user	example@brevo.com
`all_features_access`	Boolean	Describes if all the features can be accessed by the user or not	true or false
`privileges`	Object	Object showing the features for the user and its permissions	`feature`, `permissions`

For the privileges object, we will define its attributes below:

Attribute	Datatype	Description	Value
`features`	String	The features offered from Brevo	Some of the features are `landing_pages`, `api-keys`, `sales_platform`, `user_management` and `phone`
`permissions`	String	Permissions for the features	`all` or `none`

Response codes:

Response code	Message	Description
`200`	`{ "status": "ok" }`	Invitation sent successfully.
`400`	`invalid_invitation_request`	Invitation request is invalid — for example, an unsupported plan, or the user limit has been reached.
`403`	`access_denied`	Access denied to invite users.

Sample 200 success response:

1 {
2   "status": "OK",
3   "credit_notes": [
4     "TEST-123"
5   ],
6   "invoice_id": "string"
7 }

1	curl --request GET \
2	--url https://api.brevo.com/v3/organization/invited/users \
3	--header 'accept: application/json' \
4	--header 'api-key: '

1	{
2	"users": [
3	{
4	"email": "owner@company.com",
5	"is_owner": true,
6	"status": "active",
7	"feature_access": {
8	"marketing": "owner",
9	"conversations": "owner",
10	"crm": "owner"
11	}
12	},
13	{
14	"email": "pendingInvitedUser@company.com",
15	"is_owner": false,
16	"status": "pending",
17	"feature_access": {
18	"marketing": "custom",
19	"conversations": "none",
20	"crm": "full"
21	}
22	},
23	{
24	"email": "connectedInvitedUser@company.com",
25	"is_owner": false,
26	"status": "active",
27	"feature_access": {
28	"marketing": "none",
29	"conversations": "full",
30	"crm": "none"
31	}
32	}
33	]
34	}

1	{
2	"email": "invitedUser@company.com",
3	"status": "active",
4	"privileges": [
5	{
6	"feature": "Email campaign",
7	"permissions": [
8	"Create / edit / delete",
9	"Send / schedule / suspend"
10	]
11	},
12	{
13	"feature": "Templates",
14	"permissions": [
15	"Create / edit / delete",
16	"Activate / deactivate"
17	]
18	},
19	{
20	"feature": "SMS campaign",
21	"permissions": [
22	"Create / edit / delete",
23	"Send / schedule / suspend"
24	]
25	},
26	{
27	"feature": "Facebook Ads",
28	"permissions": [
29	"Schedule / pause"
30	]
31	},
32	{
33	"feature": "Landing pages",
34	"permissions": [
35	"All"
36	]
37	},
38	{
39	"feature": "Workflows",
40	"permissions": [
41	"Create / edit / delete",
42	"Activate / deactivate / Pause"
43	]
44	},
45	{
46	"feature": "Contacts",
47	"permissions": [
48	"View",
49	"Contact forms"
50	]
51	},
52	{
53	"feature": "API keys",
54	"permissions": [
55	"All"
56	]
57	},
58	{
59	"feature": "User management",
60	"permissions": [
61	"None"
62	]
63	},
64	{
65	"feature": "Sales Platform",
66	"permissions": [
67	"All"
68	]
69	},
70	{
71	"feature": "Conversations",
72	"permissions": [
73	"None"
74	]
75	}
76	]
77	}

1	{
2	"code": "method_not_allowed",
3	"message": "POST Method is not allowed on this path"
4	}

1	curl --request PUT \
2	--url https://api.brevo.com/v3/organization/user/invitation/revoke/revokeduser%40email.com \
3	--header 'accept: application/json' \
4	--header 'api-key: '

1	curl --request POST \
2	--url https://api.brevo.com/v3/organization/user/invitation/send \
3	--header 'accept: application/json' \
4	--header 'api-key: ' \
5	--header 'content-type: application/json' \
6	--data '
7	{
8	"all_features_access": false,
9	"email": "inviteuser@example.com",
10	"privileges": [
11	{
12	"feature": "sms_campaigns",
13	"permissions": [
14	"view",
15	"create_edit_delete"
16	]
17	},
18	{
19	"feature": "transactional_emails",
20	"permissions": [
21	"activate_deactivate",
22	"settings"
23	]
24	}
25	]
26	}

1	{
2	"status": "OK",
3	"credit_notes": [
4	"TEST-123"
5	],
6	"invoice_id": "string"
7	}