---
title: "Create the organization of a Microsoft platform purchase (internal producers)"
method: POST
path: "/v1/internal/platforms/microsoft/organizations"
---

# Create the organization of a Microsoft platform purchase (internal producers)

`POST /v1/internal/platforms/microsoft/organizations`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/platforms/microsoft/organizations`
- Auth: HTTP bearer

Internal; default off (503 platform_workspaces_disabled until `DECIONIS_PLATFORM_WORKSPACES_ENABLED` is 1). Only a producer whose token (`DECIONIS_DELIVERY_PRODUCERS_JSON`) carries `platforms: ["microsoft"]` may call it: no token or an unknown one is 401 producer_required, any other producer 403 platform_not_allowed, and an organization key is never accepted. Commerce passes the workspace mapping Accounts signed for a `decionis-platform` purchase, with its evidence, verbatim. Core checks the version, platform, product and environment (400 otherwise); that the Accounts organization and workspace ids derive from source_org_id, that issued_at is within the last 10 minutes, and the Ed25519 signature over the canonical (sorted-key) mapping against the current Accounts JWKS (422 accounts_evidence_invalid with reason ids, stale or signature; 503 accounts_evidence_unavailable while the JWKS is unreachable). In one transaction it creates the organization with id = source_org_id, no Core owner, source product decionis and the production environment, its default entitlement, and the synchronized Accounts workspace reference, so the buyer's later Decionis sign-in to that workspace lands in this organization. The same reference again is 200 replayed; an existing organization with any other reference, a workspace already bound elsewhere, or an organization created for another subscription is 409 organization_conflict. No person, session or key is created. The optional `subscription` is the subscription's current state from Commerce's lifecycle, outside the signature: its paid plan becomes the organization's entitlement in the same transaction (422 plan_unknown for a plan code Core does not sell, before any write), and the answer reports what it did as `subscription`. Without it the organization gets the default entitlement.

## Request body

- MicrosoftPlatformOrganizationRequest
  - `subscription` MicrosoftPlatformSubscriptionState: core-microsoft-subscription-v1: one numbered state of a decionis-platform subscription. Commerce maps the Microsoft plan to plan_code by exact plan id in its registry; revision grows with every change it records for the subscription.
    - `version` 'core-microsoft-subscription-v1', required
    - `offer_id` string, required
    - `plan_id` string, required
    - `plan_code` 'build' | 'starter' | 'defence' | 'premium' | 'scale' | 'enterprise', required: A paid Core plan; any other code is 422 plan_unknown.
    - `status` 'SUBSCRIBED' | 'SUSPENDED' | 'UNSUBSCRIBED', required
    - `revision` integer, required
  - `mapping` MicrosoftPlatformWorkspaceMapping, required: accounts-microsoft-workspace-v1, exactly as Accounts signed it; account_org_id and account_workspace_id are ExternalAccountIds.organization/workspace("decionis", source_org_id).
    - `version` 'accounts-microsoft-workspace-v1', required
    - `platform` 'microsoft', required
    - `source_org_id` string, required
    - `subscription_id` string, required
    - `account_org_id` string, required
    - `account_workspace_id` string, required
    - `account_user_id` string, required
    - `account_membership_id` string, required
    - `account_entitlement_id` string, required
    - `product` 'decionis', required
    - `environment` 'production', required
    - `display_name` string, required: One line.
    - `issued_at` string, date-time, required
  - `evidence` object, required: Ed25519 signature (base64url) over the canonical mapping, with its SHA-256, verifiable at the Accounts /.well-known/account-jwks.json.
    - `algorithm` 'Ed25519', required
    - `key_id` string, required
    - `payload_sha256` string, required
    - `signature` string, required

## Response `200`

The organization already holds this Accounts reference.

- MicrosoftPlatformOrganization
  - `status` 'provisioned' | 'replayed', required
  - `org_id` string, uuid, required: Always the mapping's source_org_id.
  - `account_org_id` string, required
  - `account_workspace_id` string, required
  - `subscription` MicrosoftPlatformSubscriptionOutcome
    - `outcome` 'applied' | 'replayed' | 'stale' | 'conflict', required
    - `reason` 'subscription' | 'revision' | 'ended': Only with outcome conflict.
    - `revision` integer: The organization's current revision.
    - `projected` boolean: False while another billing source holds the organization's entitlement.
    - `entitlement` object, nullable
      - `plan_code` string, required
      - `decision_limit_monthly` integer, nullable, required
      - `api_access` boolean, required
      - `source` string, required

## Other responses

- `201`: Provisioned.
- `400`: Structured API error
- `401`: Structured API error
- `403`: Structured API error
- `409`: Structured API error
- `422`: Structured API error
- `503`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)