List organizations to choose from
GET /fapi/v1/authorization-requests/{authorization_request_id}/organizations · called from the environment's sign-in host
Called by the hosted organization picker at /u/organization. When an application's organization_usage is require and the authorization request names no organization, the authorization endpoint looks up the user's organizations once the user has signed in. With none, the request ends with access_denied and error_description=no_organization_membership. With exactly one, that organization is bound without a screen. With two or more, the browser goes to the picker, which reads this list.
The list contains the organizations where the user has an active membership, the organization is active, and the application is enabled. It is in slug order and holds at most 100 entries; truncated: true means more exist. The organization last chosen in this session comes first and has last_used: true. name is customer data with control and direction characters removed. When an organization has no name, name is its slug. Reading the list binds nothing.
The authorization request must be pending, opened on this sign-in host, and carry the binding cookie the authorization endpoint set in this browser. The following all get the same 404 not_found:
- a malformed or unknown request
- an expired or finished request
- a request opened on another host
- a request opened in another browser
Requires the authenticated user's __Host-idp_session cookie; if the cookie is missing, expired, or revoked, returns 401 unauthenticated.
Request
Path parameter:
| Parameter | Description |
|---|---|
authorization_request_id |
The authorization_request value of the picker URL (azr_…). |
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
No body.
Response
200 OK:
| Field | Type | Description |
|---|---|---|
data[].id |
string | Organization identifier (org_…). |
data[].slug |
string | Organization slug. |
data[].name |
string | Display name, plain text. |
data[].last_used |
boolean | Whether this is the organization last chosen in this session. |
truncated |
boolean | Whether the user has more eligible organizations than are listed. |
{
"data": [
{"id": "org_01jbz6x8kq3m2n4p5r6s7t8v9w", "slug": "acme", "name": "Acme", "last_used": false},
{"id": "org_01jbz6x8kq3m2n4p5r6s7t8v9x", "slug": "globex", "name": "Globex", "last_used": false}
],
"truncated": false
}
Errors
| Status | Code | When |
|---|---|---|
| 401 | unauthenticated |
No valid session cookie. |
| 404 | not_found |
The request is malformed, unknown, expired, finished, another host's, or another browser's. |
| 409 | conflict |
The request already has an organization. |
| 503 | temporarily_unavailable |
The organization list could not be read. |
Example
curl https://example.keenauth.app/fapi/v1/authorization-requests/azr_01jbz6x8kq3m2n4p5r6s7t8v9w/organizations \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-b cookies.txt