# List credential invitations.

Returns a newest-first, paginated list scoped to the authenticated service user's organization and `X-Environment`.
Results contain metadata only. They never contain the plaintext code, claims, `validity_seconds`, or a redemption URL. Exact filters support discovery after a create response is lost, but callers must reconcile the visible metadata with their own durable create-request record before rotating a code.

Endpoint: GET /b2b/v1/credential-invitations
Version: 1.0.0
Security: BearerAuth

## Query parameters:

  - `limit` (integer)
    Maximum results to return. Omitted or non-positive values use 50; values above 100 are capped at 100.

  - `offset` (integer)
    Results to skip. Omitted or negative values use 0.

  - `status` (string)
    Filter by exact invitation status.

  - `credential_definition_id` (string)
    Filter by exact credential definition ID.

  - `email` (string)
    Filter by exact normalized email address. Leading and trailing whitespace is removed and comparison is case-insensitive through lowercase normalization.

  - `reference_id` (string)
    Filter by exact correlation identifier. This field is not unique.

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Invitation resources are isolated per environment.

## Response 200 fields (application/json):

  - `invitations` (array, required)
    Newest-first invitation metadata. Items never contain plaintext codes or credential claims.

  - `invitations.invitation_id` (string, required)
    Credential invitation ID.

  - `invitations.environment` (string, required)
    Environment selected by `X-Environment` when the invitation was created.
    Enum: "beta", "production"

  - `invitations.credential_definition_id` (string, required)
    Credential definition used for the eventual offer.

  - `invitations.credential_definition_name` (string, required)
    Credential definition name captured when the invitation was created.

  - `invitations.email` (string, required)
    Normalized recipient email required for public redemption.

  - `invitations.code_last4` (string, required)
    Last four normalized code characters for support and delivery confirmation. This is not a redeemable code.

  - `invitations.status` (string, required)
    Current invitation lifecycle state.
    Enum: "pending", "redeemed", "expired", "revoked"

  - `invitations.reference_id` (string)
    Optional correlation identifier from your system; echoed on the resource.

  - `invitations.offer_validity_seconds` (integer)
    Configured lifetime of the offer created after redemption, when supplied at creation.

  - `invitations.redeemed_offer_id` (string)
    Offer created by a successful redemption. Present only after redemption.

  - `invitations.expires_at` (string, required)
    Invitation-code expiry timestamp in RFC 3339 UTC.

  - `invitations.redeemed_at` (string)
    Successful redemption timestamp in RFC 3339 UTC.

  - `invitations.revoked_at` (string)
    Revocation timestamp in RFC 3339 UTC.

  - `invitations.created_at` (string, required)
    Creation timestamp in RFC 3339 UTC.

  - `total` (integer, required)
    Total number of invitations matching the filters before pagination.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.