---
title: "Finish a sign-in that must choose an organisation, unauthenticated"
method: POST
path: "/v1/auth/organization-selection"
tags: ["auth"]
---

# Finish a sign-in that must choose an organisation, unauthenticated

`POST /v1/auth/organization-selection`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/auth/organization-selection`
- Auth: none declared

For a Google or Microsoft sign-in that WorkOS answered with `organization_selection_required`: the device forwards the pending token and the organisations offered, and the service selects the person's one firm with the client secret the device does not hold. The operators organisation is never selected. Answers the session the email verify route answers; no firm is a 403 `no-firm`, more than one a 403 `choose-firm`.

## Request body

- object
  - `pending_authentication_token` string, required
  - `organizations` object[], required
    - `id` string, required

## Response `200`

The session: the tokens and the user.

- object
  - `access_token` string, required
  - `refresh_token` string, required
  - `organization_id` string, nullable
  - `user` object, required
    - `id` string, required
    - `email` string, required
    - `first_name` string, nullable
    - `last_name` string, nullable

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `422`: The request is well-formed but cannot be carried out as it stands.
- `429`: Too many requests; `Retry-After` says how long to wait.
- `502`: An upstream this service depends on failed or answered nonsense.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)