List my organization suggestions

GET /fapi/v1/me/organization-suggestions · called from the environment's sign-in host

Lists the organizations the authenticated user is invited to join because of the domain of one of their verified email addresses. An organization is suggested when it is active, has verified that domain with domain capture set to suggest, and the user has no membership in it (a removed or left membership also counts, so it is never suggested again). One item is returned per organization, in slug order, at most 20. An organization the user dismissed three times is not listed. If the environment's default member role cannot be granted by domain capture (an admin role, a privileged role, or a role with system permissions beyond reading the organization and its members), the list is empty. Reading changes nothing and does not require a recently verified session. Requires the authenticated user's __Host-idp_session cookie; if the cookie is missing, expired, or revoked, returns 401 unauthenticated. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token).

With @keenauth/js: await keenauth.organizations.suggestions().

Request

Headers:

No query parameters. No body.

Response

200 OK with {"data": [...]}. The response is not cached (Cache-Control: no-store).

Each item: id (odm_…, the verified domain record; use it to join or dismiss), domain (the email domain that matched), and organization with id (org_…), slug and name (display name with control and bidirectional characters removed; the slug when the organization has no name; render it as plain text).

Errors

Example

curl https://example.keenauth.app/fapi/v1/me/organization-suggestions \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt

{
  "data": [
    {
      "id": "odm_01j9a5c4000000000000000001",
      "domain": "acme.example",
      "organization": {
        "id": "org_01j9xxxxxxxxxxxxxxxxxxxxxx",
        "slug": "acme",
        "name": "Acme"
      }
    }
  ]
}

Personal data

This endpoint carries personal data: organization memberships and invitations. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.