API: Org

Invites that are neither accepted nor expired, newest first. The invite token is intentionally absent — it is returned once on creation only.

Deletes an invite that has not been accepted. Expired-but-unaccepted invites can be deleted too (cleanup). Accepted, foreign-org or unknown ids return 404.

Discovery is fetched and validated before storage. The client secret is encrypted; omitting it preserves an existing secret.

First activation path for an organization whose signup was risk-flagged (subscription pending_review, org.trial_state=sms_required). Available only while the latest subscription is pending_review AND the signup was marked sms_eligible (risk path; domain-review signups are not — they answer 409 sms_unavailable and wait for the manual review queue, which the pending_review status itself already represents). The phone is normalized: inputs WITHOUT a leading + get Russian-specific rewriting (8XXXXXXXXXX and bare 10-digit numbers become +7XXXXXXXXXX); inputs WITH a leading + keep their digits exactly as given (an explicit country code is never rewritten, even one starting with 8 — e.g. +81... stays +81..., it is not mistaken for the Russian 8-prefix) — and only the salted hash of the normalized number is ever kept: a 6-digit code is sent via the configured SMS provider and stored HMAC-hashed in Redis for 10 minutes together with the phone hash — the raw phone number is never persisted or logged. A phone already used by another organization whose trial started within the last 90 days is rejected (409 phone_already_used); the same check runs again at verify time to close the race where two organizations start with the same phone concurrently. Rate limited to 3 starts per hour per organization and per phone. A provider failure answers 502 sms_send_failed — the account simply stays pending_review (manual review remains available). Requires the owner role.

Companion of /org/trial/sms/start. Every code defect — no code requested, expired, wrong, or more than 5 attempts (the attempt counter increments before comparison; exceeding it kills the code so even the correct value stops working — request a new one via start) — yields the same uniform 422. On a correct code the code is consumed immediately (one-time, even if a later step fails) and the phone uniqueness check from /org/trial/sms/start runs again (code=phone_already_used): this closes the race where two organizations start with the same phone and the other one's verify won first. Success stores the confirmed phone hash in the signup signals (future trial dedup), atomically flips the pending_review subscription to trialing with trial dates starting now, lifts the ingest block and emits the dogfood trial-started event once. If the organization is no longer pending_review (a payment or a manual approval won the race) the answer is 409 sms_unavailable and existing access is left untouched. Requires the owner role.