> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apocor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboard a tenant

> Creates a tenant organization and emails an onboarding invite to the admin. Requires `APOCOR_ADMIN` or `RESELLER_ADMIN`.



## OpenAPI

````yaml /openapi.json post /v1/organizations/onboard
openapi: 3.1.0
info:
  title: Apocor Core API
  version: 1.0.0
  description: >-
    The Apocor Cards API is the integration surface for issuing and managing
    cards. Authenticate with your Apocor API key, onboard applicants, run KYC,
    and issue virtual or physical cards — all through one white-labeled API.
  contact:
    name: Apocor Support
    url: https://apocor.com
servers:
  - url: https://sandbox.apocor.ai
    description: Sandbox (live)
  - url: https://api.apocor.com
    description: Production
  - url: http://localhost:4000
    description: Local development
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Exchange Apocor API keys for a short-lived access token.
  - name: Applicants
    description: End-users and businesses, plus their identity verification (KYC).
  - name: KYC
    description: >-
      Identity verification settings, hosted sessions, BYOK share tokens, and
      issuer readiness.
    x-group: Identity verification (KYC)
  - name: Accounts
    description: Funding accounts that back issued cards.
  - name: Programs
    description: Card programs that define product type, currency, and BIN.
  - name: Cardholders
    description: Approved applicants turned into cardholders.
  - name: Cards
    description: Issue and manage virtual and physical cards.
  - name: Transactions
    description: Card transaction history from the issuer or local ledger.
  - name: Sandbox
    description: Sandbox-only simulation helpers for testing authorizations and KYC.
  - name: Session
    description: The authenticated principal behind the current access token.
    x-group: Account & API keys
  - name: API Keys
    description: Create, list, and revoke the API keys used to obtain access tokens.
    x-group: Account & API keys
  - name: Organizations
    description: Tenants (integrators / sub-orgs) managed on the platform.
  - name: Billing
    description: Platform credit balance, funding wallets, and the pay-as-you-go ledger.
  - name: Onboarding
    description: Invite-token onboarding flow for new users (no access token required).
  - name: Webhooks
    description: >-
      Inbound events Apocor receives from upstream providers. Apocor verifies
      the signature and processes these asynchronously — you do not call them.
  - name: System
    description: Service health probes used by load balancers and uptime monitors.
paths:
  /v1/organizations/onboard:
    post:
      tags:
        - Organizations
      summary: Onboard a tenant
      description: >-
        Creates a tenant organization and emails an onboarding invite to the
        admin. Requires `APOCOR_ADMIN` or `RESELLER_ADMIN`.
      operationId: createOrganizationsOnboard
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                type:
                  type: string
                admin_name:
                  type: string
                admin_email:
                  type: string
                  format: email
                parent_id:
                  type: string
            example:
              name: Acme Inc
              type: DIRECT
              admin_name: Alice Admin
              admin_email: alice@acme.com
      responses:
        '201':
          description: Tenant created and invite sent.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      organization:
                        $ref: '#/components/schemas/Organization'
                      invite:
                        type:
                          - object
                          - 'null'
                        properties:
                          email:
                            type: string
                          emailSent:
                            type: boolean
                          onboardingUrl:
                            type: string
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    Organization:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        type:
          type: string
          enum:
            - DIRECT
            - RESELLER
            - MANAGED
        status:
          type: string
          enum:
            - ACTIVE
            - SUSPENDED
            - CLOSED
        parentId:
          type:
            - string
            - 'null'
        createdAt:
          type: string
          format: date-time
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable, machine-readable error code.
            message:
              type: string
              description: Human-readable explanation.
  responses:
    Forbidden:
      description: The caller lacks the required role.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: FORBIDDEN
              message: APOCOR_ADMIN required
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Bearer access token obtained from `POST /v1/oauth/token` using your
        Apocor API key.

````