diff --git a/app/invite/rest.py b/app/invite/rest.py
index 80c39f177..d2618abe7 100644
--- a/app/invite/rest.py
+++ b/app/invite/rest.py
@@ -42,14 +42,33 @@ def get_invited_users_by_service(service_id):
 
 @invite.route('/<invited_user_id>', methods=['GET'])
 def get_invited_user_by_service_and_id(service_id, invited_user_id):
-    invited_user = get_invited_user(service_id, invited_user_id)
+    invited_user = get_invited_user(service_id=service_id, invited_user_id=invited_user_id)
     if not invited_user:
-        message = 'Invited user not found for service id: {} and invited user id: {}'.format(service_id,
-                                                                                             invited_user_id)
-        return jsonify(result='error', message=message), 404
+        return _invited_user_not_found(service_id, invited_user_id)
     return jsonify(data=invited_user_schema.dump(invited_user).data), 200
 
 
+@invite.route('/<invited_user_id>', methods=['POST'])
+def update_invited_user(service_id, invited_user_id):
+    fetched = get_invited_user(service_id=service_id, invited_user_id=invited_user_id)
+    if not fetched:
+        return _invited_user_not_found(service_id=service_id, invited_user_id=invited_user_id)
+
+    current_data = dict(invited_user_schema.dump(fetched).data.items())
+    current_data.update(request.get_json())
+    update_dict, errors = invited_user_schema.load(current_data)
+    if errors:
+        return jsonify(result='error', message=errors), 400
+    save_invited_user(update_dict)
+    return jsonify(data=invited_user_schema.dump(fetched).data), 200
+
+
+def _invited_user_not_found(service_id, invited_user_id):
+    message = 'Invited user not found for service id: {} and invited user id: {}'.format(service_id,
+                                                                                         invited_user_id)
+    return jsonify(result='error', message=message), 404
+
+
 def _create_invitation(invited_user):
     from utils.url_safe_token import generate_token
     token = generate_token(str(invited_user.id), current_app.config['SECRET_KEY'], current_app.config['DANGEROUS_SALT'])
diff --git a/tests/app/dao/test_invited_user_dao.py b/tests/app/dao/test_invited_user_dao.py
index 105097bc3..8c4b871f3 100644
--- a/tests/app/dao/test_invited_user_dao.py
+++ b/tests/app/dao/test_invited_user_dao.py
@@ -68,3 +68,14 @@ def test_get_invited_users_for_service_that_has_no_invites(notify_db, notify_db_
 
     invites = get_invited_users_for_service(sample_service.id)
     assert len(invites) == 0
+
+
+def test_save_invited_user_sets_status_to_cancelled(notify_db, notify_db_session, sample_invited_user):
+    assert InvitedUser.query.count() == 1
+    saved = InvitedUser.query.get(sample_invited_user.id)
+    assert saved.status == 'pending'
+    saved.status = 'cancelled'
+    save_invited_user(saved)
+    assert InvitedUser.query.count() == 1
+    cancelled_invited_user = InvitedUser.query.get(sample_invited_user.id)
+    assert cancelled_invited_user.status == 'cancelled'
diff --git a/tests/app/invite/test_invite_rest.py b/tests/app/invite/test_invite_rest.py
index 8d8783899..81716dde7 100644
--- a/tests/app/invite/test_invite_rest.py
+++ b/tests/app/invite/test_invite_rest.py
@@ -196,3 +196,58 @@ def test_get_invited_user_by_service_but_unknown_invite_id_returns_404(notify_ap
                 headers=[('Content-Type', 'application/json'), auth_header]
             )
             assert response.status_code == 404
+
+
+def test_update_invited_user_set_status_to_cancelled(notify_api, sample_invited_user):
+    with notify_api.test_request_context():
+        with notify_api.test_client() as client:
+
+            data = {'status': 'cancelled'}
+            url = '/service/{0}/invite/{1}'.format(sample_invited_user.service_id, sample_invited_user.id)
+            auth_header = create_authorization_header(
+                path=url,
+                method='POST',
+                request_body=json.dumps(data)
+            )
+            response = client.post(url,
+                                   data=json.dumps(data),
+                                   headers=[('Content-Type', 'application/json'), auth_header])
+
+            assert response.status_code == 200
+            json_resp = json.loads(response.get_data(as_text=True))['data']
+            print(json_resp)
+            assert json_resp['status'] == 'cancelled'
+
+
+def test_update_invited_user_for_wrong_service_returns_404(notify_api, sample_invited_user):
+    with notify_api.test_request_context():
+        with notify_api.test_client() as client:
+            data = {'status': 'cancelled'}
+            bad_service_id = uuid.uuid4()
+            url = '/service/{0}/invite/{1}'.format(bad_service_id, sample_invited_user.id)
+            auth_header = create_authorization_header(
+                path=url,
+                method='POST',
+                request_body=json.dumps(data)
+            )
+            response = client.post(url, data=json.dumps(data),
+                                   headers=[('Content-Type', 'application/json'), auth_header])
+            assert response.status_code == 404
+            json_response = json.loads(response.get_data(as_text=True))['message']
+            assert json_response == 'Invited user not found for service id: {} and invited user id: {}'\
+                .format(bad_service_id, sample_invited_user.id)
+
+
+def test_update_invited_user_for_invalid_data_returns_400(notify_api, sample_invited_user):
+    with notify_api.test_request_context():
+        with notify_api.test_client() as client:
+            data = {'status': 'garbage'}
+            url = '/service/{0}/invite/{1}'.format(sample_invited_user.service_id, sample_invited_user.id)
+            auth_header = create_authorization_header(
+                path=url,
+                method='POST',
+                request_body=json.dumps(data)
+            )
+            response = client.post(url, data=json.dumps(data),
+                                   headers=[('Content-Type', 'application/json'), auth_header])
+            assert response.status_code == 400