> ## Documentation Index
> Fetch the complete documentation index at: https://docs.causeloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Switch Workspace

> Switch the active workspace and issue a fresh token pair scoped to it.

A4 (E1 addendum §3.1): "same mechanics [as switch-org] within the active
org" -- the target workspace must belong to the caller's CURRENT active
org (org resolved from the `org` claim, or lazily from the caller's
workspace for a pre-E1 token that never carried one); a cross-org
workspace_id is rejected exactly like a missing membership, 403, so this
endpoint can never be used to hop orgs (that's what
POST /v1/auth/switch-org is for). Verifies an ACTIVE membership in the
requested workspace, mints a fresh token (now carrying org + staff
claims), and writes an `auth.workspace_switched` audit_log row.

NOTE: this endpoint pre-dates E1 (`/auth/switch-workspace` is A4 in the
execution addendum's endpoint inventory, aliased at
`POST /auth/sso/switch-workspace` via `switch_workspace_legacy` below) --
extended in place rather than duplicated, since a second handler at the
same route would silently shadow this one.



## OpenAPI

````yaml /openapi.json post /v1/auth/sso/switch-workspace
openapi: 3.1.0
info:
  description: Causeloop Platform Backend
  title: Causeloop API
  version: 1.0.0
servers: []
security: []
paths:
  /v1/auth/sso/switch-workspace:
    post:
      tags:
        - auth
      summary: Switch Workspace
      description: >-
        Switch the active workspace and issue a fresh token pair scoped to it.


        A4 (E1 addendum §3.1): "same mechanics [as switch-org] within the active

        org" -- the target workspace must belong to the caller's CURRENT active

        org (org resolved from the `org` claim, or lazily from the caller's

        workspace for a pre-E1 token that never carried one); a cross-org

        workspace_id is rejected exactly like a missing membership, 403, so this

        endpoint can never be used to hop orgs (that's what

        POST /v1/auth/switch-org is for). Verifies an ACTIVE membership in the

        requested workspace, mints a fresh token (now carrying org + staff

        claims), and writes an `auth.workspace_switched` audit_log row.


        NOTE: this endpoint pre-dates E1 (`/auth/switch-workspace` is A4 in the

        execution addendum's endpoint inventory, aliased at

        `POST /auth/sso/switch-workspace` via `switch_workspace_legacy` below)
        --

        extended in place rather than duplicated, since a second handler at the

        same route would silently shadow this one.
      operationId: switch_workspace_v1_auth_sso_switch_workspace_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SwitchWorkspaceBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SwitchWorkspaceResponse'
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - HTTPBearer: []
components:
  schemas:
    SwitchWorkspaceBody:
      properties:
        workspace_id:
          title: Workspace Id
          type: string
      required:
        - workspace_id
      title: SwitchWorkspaceBody
      type: object
    SwitchWorkspaceResponse:
      properties:
        access_token:
          title: Access Token
          type: string
        refresh_token:
          title: Refresh Token
          type: string
        token_type:
          default: bearer
          title: Token Type
          type: string
        workspace:
          additionalProperties: true
          title: Workspace
          type: object
      required:
        - access_token
        - refresh_token
        - workspace
      title: SwitchWorkspaceResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    HTTPBearer:
      scheme: bearer
      type: http

````