Identity and organization workspaces

A protected request has a signed actor and an effective workspace principal. Omit organization selection to use the actor's Personal workspace. Select an organization to operate as its stable principal; the actor remains separately identified for attribution. Publication access belongs to the effective principal's current membership.

Authentication

Use an M7 access token with the Blog API audience. Organization discovery and selection additionally require the orgs scope and current direct Management membership disclosed to Blog. Every organization-scoped operation, including a read, checks that membership again. A displayed or cached organization list does not grant access. See Authorization.

Routes

Route	Required input	Optional input	Result
POST /v1/member/me	None	—	member.principal_id, and username and user_id for a user actor; those two fields are null for a machine actor.
POST /v1/orgs/list	None	orgs_dpop	Current actor's discoverable organizations; a display result may come from cache.
POST /v1/orgs/refresh	None	orgs_dpop	Fresh organization discovery, replacing the previous display result.

The identity endpoint describes the actor even when the client has an organization selected. The organization response includes caller_principal_id, orgs, and cache information. An organization has its native id, stable principal_id, name, slug, access_level, and verified management_groups. Use its native id for selection and its stable principal_id for publication membership. Names are display labels.

Select an organization

Send the native organization UUID in Org or JSON org_id on protected publication operations. If both are supplied they must match, ignoring case. Null, nil, malformed, and conflicting selectors return 400.

curl -sS https://api.blog.service.m7.org/v1/publication/list \
  -H 'Authorization: Bearer ACCESS_TOKEN' \
  -H 'Org: ORGANIZATION_UUID' \
  -H 'Content-Type: application/json' \
  -d '{}'

The server resolves the selected organization using the original caller token. An organization name, a body principal override, or a previously returned organization object cannot replace the current verified facts. The org's Management tag-name grants are intersected with its publication membership permissions. The actor's personal memberships are not inherited.

If the upstream organization lookup requires a sender proof, carry the proof for that lookup in Org-DPoP, or orgs_dpop in JSON. An upstream nonce can be returned in DPoP-Nonce; regenerate the proof for the upstream lookup before retrying. This proof does not add DPoP protection to the Blog resource endpoint.

Load publication context after selection and discard old context, capability state, and pending responses whenever the actor, workspace, or publication changes. A revoked membership or unavailable live lookup fails closed; do not retry the action as Personal without explicit user selection.