List organizations (admin, platform staff)

GET/v1/admin/orgs

Returns one page of organizations (orgs) using opaque cursor (keyset) pagination. Bound the page size with limit and choose an ordering with sort (see x-sort-fields for what this endpoint accepts; the org id is appended so the ordering is total). Then walk the listing by passing the previous response's page.next_cursor back as cursor for as long as page.has_more is true. Defaults to id order, which for this server's time-ordered ids is creation order; display_name orders by the name case-insensitively. q narrows the listing to the organizations whose slug or display name starts with it, case-insensitively; a cursor carries the search it was issued for. Requires the nauthera.orgs:read scope and the orgs.read permission held through a platform role in the main org: the listing spans every organization, so a tenant's members, who hold orgs.read for their own organization, are refused.

GET/v1/admin/orgs

curl 'https://auth.example.com/v1/admin/orgs' \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

200 OK

{
  "items": [
    {
      "id": "string",
      "slug": "string",
      "display_name": "string",
      "is_main": false,
      "issuer": "string",
      "fips_mode": false,
      "fapi_mode": false,
      "email_verification_required": false,
      "created_at": "2026-01-15T09:30:00Z",
      "updated_at": "2026-01-15T09:30:00Z"
    }
  ],
  "page": {
    "limit": 50,
    "sort": "last_name,-first_name,id",
    "has_more": false,
    "has_prev": false
  }
}

Authorization

Bearer tokenOAuth 2.0nauthera.orgs:read

The access token must carry the scope shown.

Send it in the Authorization header:

The access token, as Bearer <token> (RFC 6750 §2.1) or, for a sender-constrained token, DPoP <token> (RFC 9449 §7.1). A token minted with a cnf.jkt confirmation is only accepted together with a DPoP proof signed by that key, whichever of the two schemes carries it.

The caller must also hold the permission orgs.read: Read organizations.

Query parameters

limitinteger
Maximum number of items to return in one page (1–200; default 50). A value outside that range is rejected with a 400. It may be changed freely between pages of the same walk — a cursor marks a position, not a page number.
Default50
between 1 and 200
sortstring
Ordering for the listing: a comma-separated list of fields, most significant first, a leading - marking a descending term. For example sort=last_name,-first_name sorts by last name ascending, then by first name descending.
Show moreShow less
Which fields a given endpoint accepts is listed in its x-sort-fields extension; naming anything else is a 400. A field may appear only once.

The server always appends the resource's primary key as a final term, so the ordering is TOTAL — rows that tie on every field you named still have a defined relative order, without which a page could skip or repeat them. The full ordering, including that appended term, is echoed as page.sort.

Send it on the FIRST request of a walk only: every cursor records the ordering it was issued under, so it carries forward automatically, and a sort that contradicts the supplied cursor is rejected with a 400 rather than silently reordering mid-walk.
Sortable fields: created_at, display_name, id, slug. Prefix a field with - to sort descending.
at most 256 characters · pattern ^-?[a-z][a-z0-9_]*(,-?[a-z][a-z0-9_]*)*$
cursorstring
Opaque keyset cursor identifying where a page begins. Omit it for the first page; afterwards pass the next_cursor (or prev_cursor) value from the previous response verbatim — the token itself records which direction it steps in, so there is no separate direction parameter.
Show moreShow less
The token is server-defined and MUST be treated as opaque: it is bound to the listing and sort order that issued it, and a cursor that is malformed, tampered with, or belongs to a different listing or order is rejected with a 400 rather than silently paging through the wrong set.
at most 1024 characters
qstring
Narrow the listing to the organizations whose slug or display name starts with this text, compared case-insensitively. Every character is matched literally. A cursor is bound to the search it was issued for.
2–100 characters

Headers

DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's cnf.jkt and cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.

Responses

200 OKapplication/jsonOne page of organizations.
One page of organizations.
Headers
- Cache-Controlno-store
Body
One page of organizations under cursor (keyset) pagination: items holds the page, ordered by the request's sort, and page says where it sits in the listing. Follow page.next_cursor while page.has_more is true.
- itemsarray of objectsrequired
  The organizations on this page.
  Each item:
  An organization (org) as seen by the admin API. issuer is the org's canonical OIDC issuer. admin_m2m_secret is present ONLY in the 201 create response and carries the one-time admin M2M client secret; it is never returned again.
  Show item attributesHide item attributes
  idstringrequired
  The organization id (UUID).
  slugstringrequired
  The org slug (addressed at /orgs/{slug}).
  display_namestringrequired
  is_mainbooleanrequired
  Whether this is the main org (whose admins manage all orgs).
  issuerstringrequired
  The org's canonical OIDC issuer URL.
  fips_modebooleanrequired
  Whether the org is restricted to the FIPS 140-3 approved algorithm set. Fixed at creation.
  fapi_modebooleanrequired
  Whether the org holds its clients to the FAPI 2.0 Security Profile. The stored flag: a deployment-wide pushed-authorization requirement applies whatever it says.
  email_verification_requiredbooleanrequired
  Whether an account must have a verified address before sign-in or registration gives it a session. Until it verifies, a correct password gets the verification step and a link instead.
  created_atstring · date-timerequired
  updated_atstring · date-timerequired
  email_verification_blockedboolean
  Present, and true, when verification is required but the organization has no email relay: no link can be sent, so every unverified account is kept out until an administrator verifies it or a relay is configured.
  brandingobject
  The organization's default branding document, the shape a client's branding carries: every sign-in page under the organization wears it, with a client's own branding laid over it field by field. Absent when it has none.
  admin_m2m_secretstring
  One-time admin M2M client secret; present only in the create response.
- pageobjectrequired
  Where one page sits in a cursor (keyset) paginated list, returned beside that page's items.
  Show moreShow less
  Walk a list by following next_cursor for as long as has_more is true, passing the token back verbatim as the cursor query parameter. Keep the listing and its filters the same for the whole walk; limit MAY change between pages (a cursor marks a position, not a page number), and sort travels in the cursor so it need not be resent. has_more is authoritative: it is derived from whether a further row actually exists, so a page that happens to be full is not mistaken for a page that has a successor, and a walk never costs a trailing empty request. prev_cursor steps back the same way.
  
  A cursor is opaque — server-defined, bound to this listing and sort order, and not parseable by clients. It stays valid across page-size changes but not across a change of sort order or filters; a cursor that does not belong to the request is rejected with a 400 rather than silently paging through the wrong set.
  
  Keyset paging is stable under concurrent writes, with one qualification. A row whose SORT KEY does not change is returned exactly once for the whole walk. Rows created or deleted mid-walk may or may not appear, depending on which side of the cursor they fall — and so may a row whose sort key is UPDATED mid-walk, since that moves it across the boundary: it can be seen twice or missed. Sorting by a field that does not change (the default id ordering, or created_at) avoids this entirely.
  Show child attributesHide child attributes
  limitintegerrequired
  The page size in effect: the limit that was sent, or the server's default when it was omitted. Echoed so a client resuming from a stored cursor knows the page size without having to remember it.
  Example50
  sortstringrequired
  The ordering this walk is pinned to, in the sort parameter's syntax and INCLUDING the primary-key term the server appends to make it total. Cursors carry it, so it need only be sent on the first request.
  Example"last_name,-first_name,id"
  has_morebooleanrequired
  Whether a page follows this one and next_cursor can reach it. When false this is the last page and next_cursor is absent.
  has_prevbooleanrequired
  Whether a page precedes this one and prev_cursor can reach it. False on the first page of a walk.
  Show moreShow less
  Both flags report REACHABILITY, not bare existence. A cursor that overshoots the set — a stale bookmark, or rows deleted mid-walk — returns an empty page with both flags false even though rows precede it, because an empty page has no row to anchor a cursor on. Restart the walk if you land there; a client following has_more never does.
  next_cursorstring
  Opaque cursor for the next page. Present exactly when has_more is true, and ABSENT (the field is omitted, not null) otherwise. Pass it back verbatim as the cursor query parameter; never parse it.
  at most 512 characters
  prev_cursorstring
  Opaque cursor for the previous page. Present exactly when has_prev is true, and absent otherwise. Passed back as cursor, exactly like next_cursor — the token itself records which way it steps.
  at most 512 characters
400 Bad Requestapplication/problem+jsonThe pagination parameters or the search were invalid — a malformed or foreign cursor, a cursor contradicting sort, a sort naming a field this endpoint does not accept or naming one twice, a limit outside its declared range, or a q outside its declared length.
The pagination parameters or the search were invalid — a malformed or foreign cursor, a cursor contradicting sort, a sort naming a field this endpoint does not accept or naming one twice, a limit outside its declared range, or a q outside its declared length.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
401 Unauthorizedapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
403 Forbiddenapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Problem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
- Cache-Controlno-store
- WWW-Authenticatestring
- DPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json). code is a stable machine-readable slug for the problem kind (it mirrors the suffix of type), so consumers can branch on it without parsing prose. errors is present on validation failures and lists every offending field.
- titlestringrequired
  Example"Request validation failed"
- statusintegerrequired
  Example400
- typestring · uri
  Example"urn:problem-type:validation_error"
- detailstring
  Example"One or more fields did not satisfy the API schema."
- codeenum
  The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing title or detail, which are English prose for logs. A problem whose status says everything the server knows carries no code.
  Show moreShow less
  validation_error is the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are the errors list — one entry per offending field — which a form renders on those fields. required and malformed are spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.
  
  Compatibility: this is a CLOSED enum, with the same cost as AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.
  Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error"
- instancestring
  Example"/introspect"
- request_idstring
  Example"8d94ed49-1caf-4ab3-9594-557142f2d023"
- trace_idstring
  Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
  Example"4bf92f3577b34da6a3ce929d0e0e4736"
- errorsarray of objects
  Field-level violations (present for validation errors).
  Each item:
  A single field-level validation violation.
  Show item attributesHide item attributes
  fieldstringrequired
  Offending field, dotted for nested bodies (e.g. child.id).
  Example"token_type_hint"
  codestringrequired
  Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
  Example"not_allowed"
  messagestringrequired
  Example"field token_type_hint must be one of [access_token, refresh_token]"

PreviousAdmin NextCreate an organization

List organizations (admin, platform staff)

GET/v1/admin/orgs

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body

Headers

Body

Body

Headers

Body