Identity and organization workspaces

The signed actor, selected workspace, and Post project are separate identities. Personal requests act as the authenticated user or machine. Organization requests act as the organization's stable principal while retaining the actor for attribution. Project membership belongs to that effective principal.

Authentication and selection

Use an M7 access token with audience https://api.post.service.m7.org and current service-list admission. Organization discovery and selection additionally require the orgs scope and direct current Management membership disclosed to Post. See Authorization.

Route	Required input	Optional input	Success result
POST /v1/member/me	None	—	member.principal_id; username and user_id for a user actor, otherwise null.
POST /v1/orgs/list	None	orgs_dpop	orgs, caller_principal_id, and display-cache information.
POST /v1/orgs/refresh	None	orgs_dpop	Fresh discovery, replacing earlier display data.
POST /v1/workspace/context	None	Organization selection	workspace (personal or organization), effective principal, and real actor.

member/me always identifies the signed actor. Organization entries provide native id, stable principal_id, name, slug, access_level, and verified management_groups. Use the native id to select an organization and the stable principal_id for project membership.

Send Org: ORGANIZATION_UUID or JSON org_id on protected workspace and project operations. If both are present they must match, ignoring case. Malformed, nil, null, or conflicting selectors return 400. Omit both for Personal.

curl -sS https://api.post.service.m7.org/v1/workspace/context \
  -H 'Authorization: Bearer ACCESS_TOKEN' \
  -H 'Org: ORGANIZATION_UUID' \
  -H 'Content-Type: application/json' \
  -d '{}'

Every organization-scoped operation, including a read, repeats the live recipient-authenticated membership check. A cached selection, name, roster reference, or caller-supplied organization object is not authority. The actor's Personal project memberships are not inherited by the organization.

When the upstream organization lookup requires a sender proof, pass it in Org-DPoP or JSON orgs_dpop. An upstream nonce can be returned in DPoP-Nonce; regenerate the proof for that lookup before retrying. This does not add DPoP protection to the Post resource endpoint.

Reload project context after changing actor, workspace, or project. Discard old capability state and pending responses. A revoked or unavailable organization check fails closed; never silently retry a write as Personal.