Switch Workspace
Switch the active workspace and issue a fresh token pair scoped to it.
A4 (E1 addendum §3.1): “same mechanics [as switch-org] within the active
org” — the target workspace must belong to the caller’s CURRENT active
org (org resolved from the org claim, or lazily from the caller’s
workspace for a pre-E1 token that never carried one); a cross-org
workspace_id is rejected exactly like a missing membership, 403, so this
endpoint can never be used to hop orgs (that’s what
POST /v1/auth/switch-org is for). Verifies an ACTIVE membership in the
requested workspace, mints a fresh token (now carrying org + staff
claims), and writes an auth.workspace_switched audit_log row.
NOTE: this endpoint pre-dates E1 (/auth/switch-workspace is A4 in the
execution addendum’s endpoint inventory, aliased at
POST /auth/sso/switch-workspace via switch_workspace_legacy below) —
extended in place rather than duplicated, since a second handler at the
same route would silently shadow this one.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.