Function create_invitation 

pub async fn create_invitation(
    req: HttpRequest,
    state: State<AppState>,
    body: Json<Value>,
) -> HttpResponse

POST <base>/auth/invitations — invite an address into the active organisation.

The person invited need not have an account; that is the whole reason this exists beside POST <base>/membership, which can only add somebody who has already registered.

Issued by anyone who may add members — role:admin in a default app, or whatever the app’s membership model says create takes. The check is against membership rather than against invitation on purpose: an invitation is a membership that has not happened yet, and having two answers to “who may let people in” is how they end up disagreeing.

Inviting an address that already has a pending invitation replaces it, which is what somebody clicking “invite” a second time means. The earlier link stops working.