API reference
Revoke an invite
Revokes a pending invite: its join link stops working at once. Returns the invite with `status: revoked`.
View as MarkdownUpdated Nov 1, 2026
DELETE
/api/external/v1/agency/invites/{id}also served at /api/external/agency/invites/{id}NewRevokes a pending invite: its join link stops working at once. Returns the invite with status: revoked.
An accepted invite cannot be revoked — end the management with DELETE /agency/creators/{id} instead.
Authentication
Send the creator's API key as a bearer token: Authorization: Bearer dpfn_…. See Authentication & API keys.
Needs the agency's own key, sent without X-Dropfans-Account.
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | string | Required | The invite id (inviteId / id). |
Responses
200The revoked invite.
| Name | Type | Description |
|---|---|---|
id | string | The invite’s id (inviteId when it was created). |
status | string | accepted once a creator used the link (it stays accepted), revoked after DELETE, expired 72 hours after creation, else pending.One of: pending, accepted, expired, revoked |
email | string | null | The address it was emailed to, or null. Format: email |
message | string | null | The personal note, or null. |
createdAt | string | When the invite was created. Format: date-time |
expiresAt | string | When the link stops working. Format: date-time |
acceptedAt | string | null | When a creator accepted it, or null. Format: date-time |
acceptedBy | string | null | The account id that accepted it, or null. |
Errors
| Status | Body | When |
|---|---|---|
| 400 | {"error":"Agency endpoints act as the agency itself — send them without X-Dropfans-Account.","code":"account_header_not_allowed"} | The request carried `X-Dropfans-Account`. Agency endpoints always act as the agency. |
| 401 | {"error":"Unauthorized","code":"unauthorized"} | Missing or invalid API key. |
| 403 | {"error":"This endpoint needs a verified agency's own API key.","code":"agency_key_required"} | The key is not a verified agency’s own key — a creator’s key, or a key an agency minted for one of its creators. |
| 404 | {"error":"Invite not found","code":"invite_not_found"} | No such invite for this agency (another agency’s invite gets the same answer). |
| 409 | {"error":"This invite was already accepted.","code":"invite_already_used"} | A creator already used the link (`invite_already_revoked` when it was revoked before). |
| 400 | {"error":"This endpoint acts as the key’s own account or app — call it without /creators/{creatorId}.","code":"creator_scope_not_allowed"} | Called under /api/external/v1/creators/{creatorId}/ — this endpoint always acts as the key’s own account, agency or app. |
| 403 | {"error":"This app does not have the agency API category enabled. Contact support to enable it.","code":"api_category_disabled","category":"agency"} | Your app has the Agency roster [API category](/developers/concepts/api-categories) switched off. |
Rate limiting
Every response carries the X-RateLimit-Tier header and, on limited tiers, the per-minute and per-day trios — read X-RateLimit-Remaining and X-RateLimit-Reset instead of hardcoding limits. Details in Rate limits.
Code samples
curl -X DELETE "https://www.dropfans.io/api/external/v1/agency/invites/$ACCOUNT_ID" \
-H "Authorization: Bearer $DROPFANS_API_KEY"const accountId = '…'; // from an earlier response
const res = await fetch(`https://www.dropfans.io/api/external/v1/agency/invites/${accountId}`, {
method: 'DELETE',
headers: {
Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
},
});
console.log(await res.json());import os
import requests
account_id = "…" # from an earlier response
res = requests.delete(
f"https://www.dropfans.io/api/external/v1/agency/invites/{account_id}",
headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
)
print(res.json())Questions? [email protected]