# Identity and organization workspaces

The signed actor, selected workspace, and Post project are separate identities.
Personal requests act as the authenticated user or machine. Organization
requests act as the organization's stable principal while retaining the actor
for attribution. Project membership belongs to that effective principal.

## Authentication and selection

Use an M7 access token with audience `https://api.post.service.m7.org` and
current service-list admission. Organization discovery and selection additionally
require the `orgs` scope and direct current Management membership disclosed to
Post. See [Authorization](https://m7.org/docs/api/api.post.m7.org/authorization.md).

| Route | Required input | Optional input | Success result |
| --- | --- | --- | --- |
| `POST /v1/member/me` | None | — | `member.principal_id`; `username` and `user_id` for a user actor, otherwise `null`. |
| `POST /v1/orgs/list` | None | `orgs_dpop` | `orgs`, `caller_principal_id`, and display-cache information. |
| `POST /v1/orgs/refresh` | None | `orgs_dpop` | Fresh discovery, replacing earlier display data. |
| `POST /v1/workspace/context` | None | Organization selection | `workspace` (`personal` or `organization`), effective `principal`, and real `actor`. |

`member/me` always identifies the signed actor. Organization entries provide
native `id`, stable `principal_id`, `name`, `slug`, `access_level`, and verified
`management_groups`. Use the native `id` to select an organization and the
stable `principal_id` for project membership.

Send `Org: ORGANIZATION_UUID` or JSON `org_id` on protected workspace and project
operations. If both are present they must match, ignoring case. Malformed, nil,
null, or conflicting selectors return `400`. Omit both for Personal.

```bash
curl -sS https://api.post.service.m7.org/v1/workspace/context \
  -H 'Authorization: Bearer ACCESS_TOKEN' \
  -H 'Org: ORGANIZATION_UUID' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

Every organization-scoped operation, including a read, repeats the live
recipient-authenticated membership check. A cached selection, name, roster
reference, or caller-supplied organization object is not authority. The actor's
Personal project memberships are not inherited by the organization.

When the upstream organization lookup requires a sender proof, pass it in
`Org-DPoP` or JSON `orgs_dpop`. An upstream nonce can be returned in `DPoP-Nonce`;
regenerate the proof for that lookup before retrying. This does not add DPoP
protection to the Post resource endpoint.

Reload [project context](https://m7.org/docs/api/api.post.m7.org/projects.md) after changing actor, workspace, or project.
Discard old capability state and pending responses. A revoked or unavailable
organization check fails closed; never silently retry a write as Personal.