Invitations

• —Every add is an invitation, whether or not the address has an account on Nextmail behind it. It carries the role, the addresses and the whole domains that were chosen at the time, so accepting produces exactly the access that was asked for rather than bare membership, both from Settings → Team and from the Share control on an address row. Nobody is put into a workspace they did not accept.
• —A pending invitation grants nothing. It is not a member row and not an address grant, and no authorisation path in the product reads it. The person is a stranger to every check until the moment they accept, which is the only place an invitation ever becomes access. That is why the members screen lists them apart from the people, under a heading that says what they will get rather than what they have.
• —The link is 256 bits of randomness and the database stores only a keyed hash of it, so a leaked backup does not yield a working invitation. It expires after fourteen days, and both halves have to line up to redeem it: holding the link proves somebody read mail sent to that address, and being signed in as that address proves who is accepting. Being signed in as somebody else is the refusal people actually hit, and the screen names both addresses and offers to sign out and switch, rather than leaving somebody to work out which account they are in.
• —Ignoring the mail is not a dead end either. Somebody who was invited and then signs up on their own a week later finds the invitation waiting in the workspace menu and on the workspace overview, with an Accept button, for as long as it is open. Signing up with a different address does nothing, and the invitation stays outstanding.
• —Invitations can be withdrawn, which kills the link immediately, or sent again, which mints a new link, restarts the fortnight and retires the old one. Asking twice refreshes the first invitation rather than sending two. The limits on it are anti-abuse and not a seat cap, and members are unlimited and never billed per person. One message every ten minutes to any given address, a hundred outstanding invitations per workspace, and two hundred sent in a rolling day counted per workspace and per person. The count lives in an append-only ledger rather than on the invitations themselves, so withdrawing one, deleting the role it named or deleting the workspace does not hand the allowance back.
• —POST /members on the API does the same thing the screen does: it answers 202 with the invitation rather than a member, whoever the address belongs to, and PATCH and the grant calls only work on somebody already in.
• —The waiting invitations are on the API too. GET /members/invitations lists them, POST /members/invitations/{id}/resend sends one again and DELETE /members/invitations/{id} withdraws it, and the SDK and the MCP server do the same, with a chat asking before it withdraws one.

Directory sync lets your company directory, such as Okta or Microsoft Entra, add people to the workspace when they join the company and remove them when they leave. The directory talks to Nextmail over SCIM 2.0, the standard those products use for it. It comes with the Business and Enterprise plans.

• —It is on the Privacy tab of the workspace settings page, for the owner and anyone whose role may manage the workspace. Turn on shows the SCIM base URL and a token. The token is shown once, so copy it before you close the dialog. Turning it on asks for your verification code.
• —Each person the directory sends is matched on their email address. Somebody who is already a member is linked to their directory entry and keeps their mail and their addresses. Anybody else is invited by email, with the role their groups give them or else the default role, and joins when they accept. Nobody is put into the workspace without accepting.
• —An invitation from the directory carries a role and no addresses. Give the person addresses or whole domains in Settings → Team once they have joined, or use a role that reaches every address.
• —People from your directory lists where each person stands: Member, Invited, Waiting when no invitation could be sent yet, such as for a person with no email address, and Inactive when the directory switched them off. Nextmail keeps checking, so a waiting person is invited as soon as that is possible, and an invitation that expired is sent again.
• —While directory sync is on, up to 5,000 invitations can be open at once, instead of 100, and up to 2,000 go out in a day. Past either, a person waits and is invited once there is room.
• —What the directory does is written to the workspace security log as By directory sync: every invitation, every member removed and every role change. Turning sync on or off, making a new token and changing a role setting are logged with the person who did it.

1. 1In Nextmail, open the Privacy tab of the workspace settings page, choose Turn on under Directory sync, and copy the SCIM base URL and the token.
2. 2In the Okta admin console, open the app integration you use for Nextmail, or create one, and choose SCIM as its provisioning method in the general settings.
3. 3On the Provisioning tab, paste the SCIM base URL into SCIM connector base URL, enter userName as the unique identifier field for users, and tick Push New Users, Push Profile Updates and Push Groups.
4. 4Choose HTTP Header as the authentication mode, paste the token as the bearer token, test the connector configuration and save.
5. 5Under To App, turn on Create Users, Update User Attributes and Deactivate Users. Then assign people or groups to the app, and add the groups that should give a role under Push Groups.

1. 1In Nextmail, turn directory sync on and copy the SCIM base URL and the token.
2. 2In the Microsoft Entra admin center, open Enterprise applications, choose New application, then Create your own application, and pick the option for an application that is not in the gallery.
3. 3Open Provisioning in that application and set Provisioning Mode to Automatic.
4. 4Under Admin Credentials, paste the SCIM base URL into Tenant URL and the token into Secret Token, then choose Test Connection and save.
5. 5Under Users and groups, assign the people and the groups that belong in the workspace, then start provisioning. Entra syncs on its own schedule, so the first people can take a while to appear.

The SCIM base URL is https://api.openemail.uk/scim/v2, and every request carries the token as a bearer token. A directory creates, changes and deletes people under Users and groups under Groups, and anything else it sends about a person, such as a phone number or a manager, is ignored.

• —A group needs a displayName, the name it is listed under when you give it a role.
• —A directory looks people up with a filter of one attribute and eq: userName, externalId, emails.value or id for people, and displayName, externalId or id for groups. A list returns 100 entries, or up to 200 with count, starting at startIndex.
• —Passwords stay with each person. They sign in with their own Nextmail account, and a directory never sets or changes a password.

• —Default role is the role an invitation from the directory carries when none of the person’s groups gives one. It starts as the Member role, and any role except Owner can replace it.
• —Every group the directory pushes is listed under Directory groups with the number of people in it. Give a group a role and everyone in it gets that role: members straight away, and invited people when they accept.
• —Somebody in several groups that give a role gets one of them, the first in the order Admin, Member, Viewer, Developer, Billing, then the roles you made, by name. A directory never gives the Owner role.
• —A group role replaces a role given by hand, and it is applied again each time the directory changes that person or one of their groups. Take the role off the group, or the person out of the group, and they keep the role they hold then.
• —Changing the default role or a group role asks for your verification code.

• —When the directory deactivates a person or deletes them, Nextmail withdraws their open invitation and ends their membership, with every address and domain they were given. Their Nextmail account is never deleted, and the mail of the workspace stays where it is.
• —A member removed this way is also signed out of every device when the email address of their account is on a domain the workspace has verified. An account on any other address stays signed in and no longer reaches the workspace.
• —A deactivated person stays in the list as Inactive, and activating them again in the directory invites them again. A deleted person leaves the list.
• —A new email address for a person removes the old address from the workspace, and the new one is matched or invited like anybody new.
• —The owner of the workspace is never removed by the directory.
• —New token replaces the token and stops the old one at once, so the directory cannot sync until the new one is pasted in.
• —Turn off stops the directory at once: its token stops working, and the group roles set here are deleted along with the list of people from the directory. Members stay members with the roles they hold, and invitations already sent stay open.
• —On a plan without directory sync nothing syncs: the directory’s requests are refused, and nobody is added or removed until the workspace is on Business or Enterprise again.