add invitation and privilege to the api