PATCH /v1/auth/session
Sets the session's active organization and project; dashboard requests then act in that project.

Authentication

API Key (cookie: __Host-b3os_session)

Header Parameters

x-b3os-csrf string required header
The `csrf_token` from `GET /v1/auth/session`.
Example: "9f8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d"

Request Body required

application/json
org_id string
project_id string

Responses

200 The session.
application/json
object string REQUIRED
Enum: auth_session
user object REQUIRED
id string REQUIRED
email string (email) REQUIRED
name string | null REQUIRED
image_url string (uri) | null REQUIRED
org object | null REQUIRED
The active organization, or `null` before the user has one.
id string REQUIRED
object string REQUIRED
Enum: organization
name string REQUIRED
slug string REQUIRED
role string | null REQUIRED
The caller's role; `null` for API keys.
Enum: owner, admin, member, null
plan string REQUIRED
Enum: beta
created_at string (date-time) REQUIRED
metadata object REQUIRED
Up to 16 string key-value pairs you attach to an object for your own use. Keys are 1 to 40 characters of `A-Z a-z 0-9 _ . : -`; values are at most 500 characters. B3OS never interprets them.
project object | null REQUIRED
The active project, or `null`.
id string REQUIRED
object string REQUIRED
Enum: project
org_id string REQUIRED
name string REQUIRED
created_at string (date-time) REQUIRED
updated_at string (date-time) REQUIRED
metadata object REQUIRED
Up to 16 string key-value pairs you attach to an object for your own use. Keys are 1 to 40 characters of `A-Z a-z 0-9 _ . : -`; values are at most 500 characters. B3OS never interprets them.
orgs object[] REQUIRED
Array of:
id string REQUIRED
name string REQUIRED
role string REQUIRED
Enum: owner, admin, member
needs_invite boolean REQUIRED
`true` until the user belongs to an organization (redeem an invite code).
csrf_token string REQUIRED
Send as `x-b3os-csrf` on every cookie-authenticated write.
expires_at string (date-time) REQUIRED
400 The request failed validation (`invalid_request`, `invalid_url`).
401 Missing, malformed, expired or revoked credentials (`unauthorized`).
403 Authenticated but not allowed (`forbidden`, `egress_denied`).
404 No such project in your organization (`project_not_found`).
413 The request body exceeds this operation's limit.
415 The Content-Type is not accepted by this operation.
429 A rate, concurrency or quota limit applies (`rate_limited`, `concurrency_limited`, `quota_exceeded`).
500 Something failed inside B3OS (`internal`). Retry with backoff.
503 The node or the product is not available right now (`node_unavailable`, `product_unavailable`, `capacity_unavailable`).
curl -X PATCH 'https://beta.b3os.org/v1/auth/session' \  -H 'Authorization: Bearer YOUR_API_TOKEN' \  -H 'x-b3os-csrf: 9f8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d' \  -H 'Content-Type: application/json' \  -d '{  "project_id": "prj_01m5t59p860z6neq6dvmsejm58"}'
const response = await fetch('https://beta.b3os.org/v1/auth/session', {  method: 'PATCH',  headers: {      "Authorization": "Bearer YOUR_API_TOKEN",      "Content-Type": "application/json",      "x-b3os-csrf": "9f8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d"  },  body: JSON.stringify({    "project_id": "prj_01m5t59p860z6neq6dvmsejm58"  })});const data = await response.json();console.log(data);
import requestsheaders = {    'Authorization': 'Bearer YOUR_API_TOKEN',    'x-b3os-csrf': '9f8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d'}response = requests.patch('https://beta.b3os.org/v1/auth/session', headers=headers, json={  "project_id": "prj_01m5t59p860z6neq6dvmsejm58"})print(response.json())
200 Response
{  "object": "auth_session",  "user": {    "id": "usr_01m5t3jv4b5sappg7vzv1rwx6x",    "email": "dev@example.com",    "name": "Dana Dev",    "image_url": null  },  "org": null,  "project": null,  "orgs": [],  "needs_invite": true,  "csrf_token": "9f8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d",  "expires_at": "2026-11-24T22:10:00.000Z"}
Ask a question... ⌘I