Organization Selection

Select Staff Organization

Used by the staff web GUI after authentication when user has multiple orgs:

POST /smart-auth/select-staff-organization
Content-Type: application/json
Authorization: Bearer <temporary-token-from-authenticate>

Request

{
  "org_id": "chosen-org-uuid"
}

Response

Full token scoped to the chosen organization:

{
  "access_token": "eyJhbGciOiJFUzI1NiIs...",
  "token_type": "bearer",
  "org_id": "chosen-org-uuid",
  "org_name": "City Hospital",
  "roles": ["doctor"],
  "privileges": ["view_patients", "manage_encounters"],
  "practitioner": "practitioner-uuid",
  "practitioner_id": "ZCT_doctor_001",
  "practitioner_reference": "Practitioner/ZCT_doctor_001"
}

Select Organization (Generic)

Used by tests and the mobile app — resolves patient memberships first, then staff:

POST /smart-auth/select-organization
Content-Type: application/json
Authorization: Bearer <temporary-token>

Request

{
  "org_id": "chosen-org-uuid"
}

Same response format as above. This endpoint auto-detects whether the user is staff or patient and returns appropriate claims.

Three Auth Paths

Endpoint	Used By	Checks
`/select-staff-organization`	Staff web GUI	Staff memberships only
`/select-organization`	Tests + mobile	Patient memberships first, then staff
Auto-login (in `/authenticate`)	Single-org users	Returns token directly

All three paths return consistent roles[], privileges[], and JWT claims.