# List organizations to choose from

`GET /fapi/v1/authorization-requests/{authorization_request_id}/organizations` · called from the environment's sign-in host

Called by the hosted organization picker at `/u/organization`. When an application's `organization_usage` is `require` and the authorization request names no `organization`, the authorization endpoint looks up the user's organizations once the user has signed in. With none, the request ends with `access_denied` and `error_description=no_organization_membership`. With exactly one, that organization is bound without a screen. With two or more, the browser goes to the picker, which reads this list.

The list contains the organizations where the user has an active membership, the organization is active, and the application is enabled. It is in slug order and holds at most 100 entries; `truncated: true` means more exist. The organization last chosen in this session comes first and has `last_used: true`. `name` is customer data with control and direction characters removed. When an organization has no name, `name` is its slug. Reading the list binds nothing.

The authorization request must be pending, opened on this sign-in host, and carry the binding cookie the authorization endpoint set in this browser. The following all get the same `404 not_found`:

- a malformed or unknown request
- an expired or finished request
- a request opened on another host
- a request opened in another browser

Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`.

## Request

Path parameter:

| Parameter | Description |
| --- | --- |
| `authorization_request_id` | The `authorization_request` value of the picker URL (`azr_…`). |

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |

No body.

## Response

`200 OK`:

| Field | Type | Description |
| --- | --- | --- |
| `data[].id` | string | Organization identifier (`org_…`). |
| `data[].slug` | string | Organization slug. |
| `data[].name` | string | Display name, plain text. |
| `data[].last_used` | boolean | Whether this is the organization last chosen in this session. |
| `truncated` | boolean | Whether the user has more eligible organizations than are listed. |

```json
{
  "data": [
    {"id": "org_01jbz6x8kq3m2n4p5r6s7t8v9w", "slug": "acme", "name": "Acme", "last_used": false},
    {"id": "org_01jbz6x8kq3m2n4p5r6s7t8v9x", "slug": "globex", "name": "Globex", "last_used": false}
  ],
  "truncated": false
}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 404 | `not_found` | The request is malformed, unknown, expired, finished, another host's, or another browser's. |
| 409 | `conflict` | The request already has an organization. |
| 503 | `temporarily_unavailable` | The organization list could not be read. |

## Example

```bash
curl https://example.keenauth.app/fapi/v1/authorization-requests/azr_01jbz6x8kq3m2n4p5r6s7t8v9w/organizations \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt
```