> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leapfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Invite-only access

> Friends-and-family codes for originating users

## When it applies

A partner stays public until Leap Financial turns on invite-only access. While the partner is public, anyone with a `referenceId` can originate a transfer, and `POST /partner/invitations` returns `403 INVITE_ONLY_NOT_ENABLED`.

When invite-only is on, the person who **starts** a send, cash deposit, money request, or deferred payout must redeem a code first. The person who **pays** a fund request, or **claims** a payout, does not.

Host and authentication: [Partner API overview](/raas-widgets/api-reference/introduction).

## Check access

```bash theme={null}
curl "$BASE_URL/partner/access?referenceId=wa:%2B50255551212" \
  -H "X-API-Key: $API_KEY"
```

A public partner always returns `granted: true`. An invite-only partner returns `granted: false` until that `referenceId` redeems a code.

Creating an originating link without a grant returns `403 USER_NOT_INVITED`.

## Codes

Single-use codes are generated by the API. Universal codes are a shared passcode, for example `#lola123ABC`. Matching ignores case, a leading `#`, and surrounding spaces.

```bash theme={null}
curl -X POST "$BASE_URL/partner/invitations/redeem" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "code": "#lola123ABC", "referenceId": "wa:+50255551212" }'
```

| Result | Code |
| - | - |
| First redeem, or the same `referenceId` again | `granted: true` |
| Single-use code already used by someone else | `409 INVITATION_ALREADY_REDEEMED` |
| Unknown, expired, revoked, disabled, or exhausted | `400 INVITATION_INVALID` |

The phone number on an SMS is for delivery tracking. The code is not bound to that phone.

## Templates

`linkTemplate` is an `https` URL that contains `{code}`. `smsTemplate` must contain `{code}` and may contain `{link}` only when a link template exists. Any other `{placeholder}` is `400 INVALID_TEMPLATE`.

The SMS sender is configured by Leap. Until it is set, sending an SMS returns `409 INVITATION_SMS_NOT_CONFIGURED`.

## Who entered

`GET /partner/access-grants` lists people who redeemed a code. Reference ids in that list and in the CSV export stay masked.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.