# Identity and organization workspaces

A protected request has a signed actor and an effective workspace principal.
Omit organization selection to use the actor's Personal workspace. Select an
organization to operate as its stable principal; the actor remains separately
identified for attribution. Publication access belongs to the effective
principal's current membership.

## Authentication

Use an M7 access token with the Blog API audience. Organization discovery and
selection additionally require the `orgs` scope and current direct Management
membership disclosed to Blog. Every organization-scoped operation, including a
read, checks that membership again. A displayed or cached organization list
does not grant access. See [Authorization](https://m7.org/docs/api/api.blog.service.m7.org/authorization.md).

## Routes

| Route | Required input | Optional input | Result |
| --- | --- | --- | --- |
| `POST /v1/member/me` | None | — | `member.principal_id`, and `username` and `user_id` for a user actor; those two fields are `null` for a machine actor. |
| `POST /v1/orgs/list` | None | `orgs_dpop` | Current actor's discoverable organizations; a display result may come from cache. |
| `POST /v1/orgs/refresh` | None | `orgs_dpop` | Fresh organization discovery, replacing the previous display result. |

The identity endpoint describes the actor even when the client has an
organization selected. The organization response includes `caller_principal_id`,
`orgs`, and cache information. An organization has its native `id`, stable
`principal_id`, `name`, `slug`, `access_level`, and verified `management_groups`.
Use its native `id` for selection and its stable `principal_id` for publication
membership. Names are display labels.

## Select an organization

Send the native organization UUID in `Org` or JSON `org_id` on protected
publication operations. If both are supplied they must match, ignoring case.
Null, nil, malformed, and conflicting selectors return `400`.

```bash
curl -sS https://api.blog.service.m7.org/v1/publication/list \
  -H 'Authorization: Bearer ACCESS_TOKEN' \
  -H 'Org: ORGANIZATION_UUID' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

The server resolves the selected organization using the original caller token.
An organization name, a body principal override, or a previously returned
organization object cannot replace the current verified facts. The org's
Management tag-name grants are intersected with its publication membership
permissions. The actor's personal memberships are not inherited.

If the upstream organization lookup requires a sender proof, carry the proof
for that lookup in `Org-DPoP`, or `orgs_dpop` in JSON. An upstream nonce can be
returned in `DPoP-Nonce`; regenerate the proof for the upstream lookup before
retrying. This proof does not add DPoP protection to the Blog resource endpoint.

Load [publication context](https://m7.org/docs/api/api.blog.service.m7.org/context-route.md) after selection and discard old
context, capability state, and pending responses whenever the actor, workspace,
or publication changes. A revoked membership or unavailable live lookup fails
closed; do not retry the action as Personal without explicit user selection.