---
title: "Switch Active Organization"
method: POST
path: "/v1/organizations/me/switch"
tags: ["organizations"]
---

# Switch Active Organization

`POST /v1/organizations/me/switch`

Point the caller's identity at another organization they belong to.

Distinct from ``PATCH /me``, which renames the organization already active.
This changes which organization every later request is scoped to, so
workspaces, keys, budgets and usage all follow it. Answers 404 for an
organization the caller holds no active membership in, whether or not it
exists.

## Request body

- SwitchActiveOrganizationRequest — Point the caller's identity at one of the organizations they belong to. The one request in this surface that names an organization by id, and it is not a hole in the tenant boundary: an id the caller holds no active membership in answers 404, so it says nothing about whether the organization exists.
  - `organization_id` string, uuid, required

## Response `200`

Successful Response

- OrganizationMembershipContextPublic — An organization plus the caller's standing in it. What every tenancy page reads first: which organization it is looking at, and what the caller may do there.
  - `byo_provider_keys_allowed` boolean
  - `caller` CallerIdentityPublic — Who the caller is, as against what they may do. The account control at the foot of the dashboard's sidebar draws a person, and no authenticated route reported the caller's own name or address, so it drew a role for everybody who could reach it: "Operator", which is not a name and on a multi-tenant deployment was not even true (mozilla-ai/otari#832). Carried on the membership context for the reason ``deployment_operator`` is: the shell reads that context before it paints, so an identity taken from it needs no request of its own and cannot arrive a beat after the chrome it names. Publishing it costs nothing either, since it is the caller's own identity and they are holding the credential that resolved to it. Both fields are nullable, and for opposite reasons. A local operator identity has no address, because first boot provisions it with a name and nothing to sign in with but the master key; a member added to the roster by address has no name until they claim the identity and supply one. So a shell has to be ready to draw either one alone.
    - `email` string, nullable
    - `full_name` string, nullable
    - `user_id` string, uuid, required
  - `deployment_operator` boolean
  - `organization` OrganizationPublic, required
    - `created_at` string, date-time, required
    - `created_by_user_id` string, uuid, nullable
    - `id` string, uuid, required
    - `name` string, required
    - `slug` string, required
    - `updated_at` string, date-time, nullable
  - `organization_member_id` string, uuid, required
  - `provider_key_encryption_available` boolean
  - `role` string, required
  - `status` string, required
  - `workspace_memberships` CallerWorkspaceMembershipPublic[]
    - `name` string, required
    - `role` string, required
    - `workspace_id` string, uuid, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-31** `eae05f7dd3cd` — 1 info
  - added the optional property `caller` to the response with the `200` status
- **2026-08-28** `c3c91c790f80` — 2 info
  - added the optional property `deployment_operator` to the response with the `200` status
  - added the optional property `provider_key_encryption_available` to the response with the `200` status
- **2026-08-25** `ae3e1cd7925a` — 1 info
  - endpoint added
- **2026-08-25** `1725b1abe9a0` — 1 breaking
  - api path removed without deprecation
- **2026-08-24** `6d9979b0b62b` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/organizations/me/switch/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/6240738fd489/schema)