---
title: "Silent Authenticate"
method: POST
path: "/authenticate/silent"
---

# Silent Authenticate

`POST /authenticate/silent`

Exchange a one-time silent authorization code and rotate cookies.

The legacy (routing-disabled) branch also backs same-account
organization switching -- including the audited platform-admin
cross-organization escalation in
``AuthService.resolve_token_membership`` -- so the submitted token's
authorized organization is intentionally allowed to differ from
``authenticated_user``'s current organization. Only the underlying
account (``sub`` and, once resolved, ``decision.user.id``) must match;
which organization that account is authorized to reach for is decided
exclusively by ``resolve_token_membership``, not re-derived here.

## Request body

- union
  - AuthoritativeSilentAuthenticateRequest — One-time code exchange for authoritative silent authentication.
    - `code` string, required
    - `code_verifier` string, required
    - `nonce` string, required
    - `state` string, required
  - SilentAuthenticateRequest — Deployed token payload used before authoritative routing is enabled.
    - `access_token` string, required
    - `id_token` string, required
    - `refresh_token` string, nullable
    - `expires_in` integer, required
    - `organization` string, nullable

## Response `200`

Successful Response

- SilentAuthenticateResponse — Response after successful silent authentication.
  - `success` boolean, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)