> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-enrolment-in-authentik/create-an-invitation.md).

# Create an Invitation

### Prerequisites

Before creating an invitation, verify that the Authentik deployment contains the required enrollment resources.

For a Participant/IDP deployment, the blueprint should provide an invitation enrollment flow and a policy that saves OE attributes to the new user.

For the Operator deployment, the central Authentik blueprint must additionally support federated identity metadata and the central federated JIT enrollment flow.

### Procedure

1. Sign in to the target Authentik Admin Interface with an administrator account which was created at [initial setup](/infrastructure/user-management-package/deployment-steps/post-installation-steps.md#set-the-authentik-server-administrator-account).
2. Navigate to: **Directory → Invitations**
3. Click **New invitation**.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FOI1ImTyFa6ktZHweTXlJ%2FScreenshot%202026-09-08%20at%2001.25.20.png?alt=media&amp;token=150ba3c7-487a-4528-a69c-320b969ec5a3" alt=""><figcaption></figcaption></figure>

4. Configure the invitation.

| Field          | Recommended value                                                                   |
| -------------- | ----------------------------------------------------------------------------------- |
| **Name**       | Descriptive operational name, for example `OE Participant User - alice@example.com` |
| **Flow**       | OE invitation enrollment flow configured by the blueprint                           |
| **Expires**    | Set according to the organization's onboarding policy                               |
| **Single Use** | Enabled/recommended for individual onboarding                                       |
| **Attributes** | Populate the OE user metadata described below                                       |

5. Add the user-specific custom attributes.

#### Data Space Participant Authentik invitation example

```json
{
  "email": "alice@example.com",
  "orgId": "participant-a",
  "walletId": "1",
  "signerServer": "https://signer.participant-a.example.com",
  "wellKnownUrl": "https://participant-a.example.com/.well-known/..."
}
```

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FU86GMeTNjFvHV3r3LU57%2FScreenshot%202026-09-08%20at%2002.14.33.png?alt=media&amp;token=0ab30b7f-b3ef-4aa0-aff5-eaefd1d5fc0b" alt=""><figcaption></figcaption></figure>

#### Data Space Operator Authentik invitation example

```json
{
  "email": "operator.user@example.com",
  "orgId": "dataspace-operator",
  "walletId": "1",
  "signerServer": "https://signer.operator.example.com",
  "wellKnownUrl": "https://operator.example.com/.well-known/...",
  "upstream_idp": "main-authentik"
}
```

{% hint style="info" %}
`upstream_idp` is primarily meaningful for federation. For a purely local Data Space Operator account, use it for Signer Server request authorisation and it is a required parameter.
{% endhint %}

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FG8AxMJjvLHvGiBZsiGEu%2FScreenshot%202026-09-08%20at%2002.15.41.png?alt=media&amp;token=98240039-af61-4800-b419-52c81c10e454" alt=""><figcaption></figcaption></figure>

6. Create the invitation.
7. Open the invitation and obtain the generated invitation URL.
8. Deliver the invitation through an approved channel.

   If SMTP is configured, Authentik can send the invitation by email as highlighted within the orange rectangle. Otherwise, securely copy and distribute the unique invitation URL as illustrated within the green rectangle.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2F4SC3MSOumbGj9n2dX0DK%2FScreenshot%202026-09-08%20at%2002.20.33.png?alt=media&amp;token=a3ba54f0-a8d8-4b6e-b22b-9a8f5a1aac10" alt=""><figcaption></figcaption></figure>

#### Enrollment behavior

When the user opens the invitation URL:

1. Authentik validates the invitation token.
2. Invitation attributes are loaded into the enrollment flow.
3. The user enters their username, full name, and password.
4. Authentik creates the account.
5. The OE enrollment policy copies the invitation values into the Authentik user attributes.
6. The user is redirected to the configured application.

#### Post-enrollment verification

Navigate to:

**Directory → Users → `<user>` → Custom Attributes** or **Directory → Users → `<user>` → Edit User → Advanced settings → Attributes**

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FjOMB5XOpbFR9lgpHRuuD%2FScreenshot%202026-09-07%20at%2022.41.09.png?alt=media&amp;token=5dbfab6f-0287-49f2-bb7c-b24c85200f97" alt=""><figcaption></figcaption></figure>

Verify the expected values.

Example:

```json
{
  "orgId": "participant-a",
  "walletId": "1",
  "signerServer": "https://signer.participant-a.example.com",
  "wellKnownUrl": "https://participant-a.example.com/.well-known/..."
}
```

Then authenticate as the user and verify that the OIDC token contains the corresponding claims.

#### Troubleshooting

This section targets common occurred errors resolution for this procedure.&#x20;

It will be updated based on errors and issues encountered by organizations during deployment and operation.

| Symptom                                     | Checks                                                                                                                                        |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Invitation link is invalid                  | Verify expiration, enabled status, and whether a single-use invitation has already been redeemed.                                             |
| Email already exists                        | Check whether the email is already assigned to another Authentik user. The documented OE enrollment flow can deny duplicate-email enrollment. |
| Username already exists                     | Select another username. The documented flow can deny duplicate usernames.                                                                    |
| User created but OE attributes are missing  | Verify the attribute-saving policy and the invitation custom attributes.                                                                      |
| Attributes exist but JWT claims are missing | Verify provider scope mappings and confirm that the client requests the required OE scopes.                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-enrolment-in-authentik/create-an-invitation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.