# Choose an organization

`POST /fapi/v1/authorization-requests/{authorization_request_id}:select-organization` · called from the environment's sign-in host

Binds the organization the user chose on the hosted picker to the authorization request. The server checks the choice again. It is accepted only if `organization_id` is in the list from [List organizations to choose from](/docs/api/fapi/authorization-requests/organizations/list) for this user and application at the time of the call. Any other value gets `422 validation_failed` and nothing is bound, including:

- another user's organization
- an organization from another environment
- an organization where the application is not enabled
- a malformed id

On success the organization is written to the request once and cannot change. The answer carries `continue_url`, the authorization endpoint's resume URL. The browser goes there and authorization continues with the organization bound.

The request conditions and the `404` answer are the same as for the list. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`.

## Request

Path parameter:

| Parameter | Description |
| --- | --- |
| `authorization_request_id` | The `authorization_request` value of the picker URL (`azr_…`). |

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |
| `Content-Type` | yes | `application/json`. |

Body:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | yes | The `id` of a listed organization (`org_…`). |

## Response

`200 OK`:

| Field | Type | Description |
| --- | --- | --- |
| `continue_url` | string | Where the browser continues: the authorization endpoint's resume URL. |

```json
{"continue_url": "/oauth2/authorize/resume?authorization_request=azr_01jbz6x8kq3m2n4p5r6s7t8v9w"}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 400 | `malformed_request` | The body is not valid JSON. |
| 400 | `unknown_field` | The body has a field other than `organization_id`. |
| 401 | `unauthenticated` | No valid session cookie. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 404 | `not_found` | The request is malformed, unknown, expired, finished, another host's, or another browser's. |
| 409 | `conflict` | The request already has an organization. |
| 413 | `payload_too_large` | The body is too large. |
| 415 | `unsupported_media_type` | `Content-Type` is not `application/json`. |
| 422 | `validation_failed` | `organization_id` is missing or is not one of the listed organizations. |
| 503 | `temporarily_unavailable` | The organization list could not be read. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/authorization-requests/azr_01jbz6x8kq3m2n4p5r6s7t8v9w:select-organization \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"organization_id": "org_01jbz6x8kq3m2n4p5r6s7t8v9w"}'
```