Getting 404 error on calling invitations API.

[aupadhyay-comm]

Select Topic Area

Bug

Body

User is the owner of the organization and pat scope contains :
admin: org
read: user
repo

invitation api is fired
https://api.github.com/orgs/<organization_name>/invitations
with the valid pat with mentioned scope. But we are getting 404 not found error!

curl-err:[No error] http-resp:[404] url:[https://api.github.com/orgs/<org_name>/invitations] server-resp:[{"message":"Not Found","documentation_url":"https://docs.github.com/rest/orgs/members#list-pending-organization-invitations","status":"404"}]

Could you please suggest how this can be possible?

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[ruturaj-018]

Hi @aupadhyay-comm 👋,
A 404 Not Found here usually doesn’t mean the endpoint is wrong — it’s most often due to permissions or ownership issues. A couple of things you can check:
✅ Make sure the PAT belongs to a user who is actually an owner of the organization (not just a member).
✅ Confirm the PAT has the admin:org scope (looks like you’ve already done this).
🔍 Double-check the URL — the <organization_name> must be the org’s login/handle (e.g., https://api.github.com/orgs/my-org/invitations), not the display name.
🔐 If your org uses SAML SSO, the PAT has to be authorized for the org.
📝 One tricky bit: if you call this API with a token that isn’t from an owner, GitHub will return 404 instead of 403 (to avoid leaking org details).
So in most cases, this happens because either the org name is slightly off or the token isn’t recognized as belonging to a valid owner.

Hope that helps clear it up!

[aupadhyay-comm]

If PAT belongs to the user also and PAT is also authorized for the org . Is there a way we get 404 not found exception for that invitations API?

[aupadhyay-comm]

And also customer is saying their org doesn't use invitations. Is there a way we can turn off invitations ? Or is it possible that if an organization never used invitations then they might get 404 error?

[ruturaj-018]

If the PAT belongs to the user and has the correct scopes (for example, admin:org for organization management), then normally the invitations API should return results and not 404. However, there are cases where you might see 404 Not Found even with a valid token:

Resource not applicable: Some organizations don’t rely on invitations at all — for example, Enterprise Managed Users (EMU) or SSO-enforced orgs where user provisioning is handled by an identity provider. In those cases, the invitations API isn’t available and will return 404.

Permissions masking: GitHub sometimes returns 404 instead of 403 to avoid leaking information when the user or token doesn’t actually have access.

To your second question: there is no switch to “turn off” invitations. The feature is built-in. But if an organization is set up in such a way that invitations are never used (like with EMU/SSO), then calling the invitations API may simply result in a 404 because that functionality does not apply in that context.

[aupadhyay-comm]

If PAT belongs to the user also and PAT is also authorized for the org . Is there a way we get 404 not found exception for that invitations API?

And also customer is saying their org doesn't use invitations. Is there a way we can turn off invitations ? Or is it possible that if an organization never used invitations then they might get 404 error?

I want these answers urgently if someone is available.

[ruturaj-018]

1. 404 for Invitations API even with valid PAT
   If the Personal Access Token (PAT) belongs to a user who is a member of the organization and is properly scoped (e.g., admin:org for org-level APIs), you normally shouldn’t get a 404 on the Invitations API.
   A 404 from GitHub’s REST API can mean:
   The endpoint doesn’t exist (wrong path, typo, or wrong API version).
   The authenticated user doesn’t have access to that resource (sometimes GitHub uses 404 instead of 403 to avoid leaking info about the resource).
   The feature isn’t enabled (if org invitations are never used / disabled, GitHub may respond with 404).
   So yes — you can get 404 if the org doesn’t use invitations or if the PAT doesn’t have proper scopes.

2. Can invitations be turned off?
   No, organizations cannot “turn off” the invitations feature in GitHub. It’s part of how users are added.
   However:
   If the org uses SSO (Single Sign-On) or Enterprise Managed Users (EMU), then invitations may not be used directly, since user provisioning is handled via identity provider (Okta, Azure AD, etc.).
   In such cases, the invitations endpoint may return 404 because it’s not applicable.

3. Org never used invitations → 404?
   Yes, if the org is set up in such a way that invitations were never used (like EMU/SSO provisioning), then calling the invitations API may return 404 Not Found.
   This doesn’t mean your PAT is invalid — just that the endpoint/resource doesn’t exist for that org context