The Agent Authorisation API uses an invitationId parameter to Get an invite and Cancel an invite.
The invitationId is only available from the Get all authorisation requests for the last 30 days API, but even here it is not sent as a parameter.
It is only provided in the _links.self.href parameter which is a URL path with the invitationId on the end.
This means we have to parse this from the URL which can potentially go wrong.
The invitationId is also returned in the Create a new authorisation Headers as part of the same href URL.
Why not just return the invitationId?
Fix
Create a new authorisation should return the invitationId.
Get all authorisation requests for the last 30 days should have an invitationId parameter.