From a9050fff02889e8f70701953fe1d976a4518db82 Mon Sep 17 00:00:00 2001
From: Evan Purkhiser <git@evanpurkhiser.com>
Date: Mon, 31 Aug 2026 11:21:59 -0400
Subject: [PATCH 1/2] feat(auth): Clear active organization context

Expose an auth-config DELETE operation that removes the session's active organization. This lets the login UI clear both its URL context and the server-side post-login fallback.
---
 src/sentry/api/endpoints/auth_config.py       | 21 ++++++++++++++++---
 src/sentry/api/urls.py                        |  7 ++++++-
 .../sentry/api/endpoints/test_auth_config.py  | 15 +++++++++++++
 3 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/src/sentry/api/endpoints/auth_config.py b/src/sentry/api/endpoints/auth_config.py
index dc28d10406dd..de4efc960257 100644
--- a/src/sentry/api/endpoints/auth_config.py
+++ b/src/sentry/api/endpoints/auth_config.py
@@ -5,6 +5,7 @@
 from django.http.request import HttpRequest
 from django.http.response import HttpResponseBase
 from django.urls import reverse
+from drf_spectacular.utils import extend_schema
 from rest_framework.request import Request
 from rest_framework.response import Response
 
@@ -22,6 +23,7 @@
 from sentry.models.organization import Organization
 from sentry.users.models.authenticator import Authenticator
 from sentry.utils.auth import (
+    clear_active_org,
     get_org_redirect_url,
     get_pending_2fa_user,
     has_user_registration,
@@ -44,11 +46,24 @@ class AuthConfigResponse(TypedDict):
     loginBanner: NotRequired[str]
 
 
+@control_silo_endpoint
+class AuthConfigClearOrganizationEndpoint(Endpoint):
+    publish_status = {"POST": ApiPublishStatus.PRIVATE}
+    owner = ApiOwner.FOUNDATIONS
+    permission_classes = ()
+
+    @extend_schema(
+        operation_id="Clear active organization from auth session",
+        responses={204: None},
+    )
+    def post(self, request: Request) -> Response:
+        clear_active_org(request)
+        return Response(status=204)
+
+
 @control_silo_endpoint
 class AuthConfigEndpoint(Endpoint, OrganizationMixin):
-    publish_status = {
-        "GET": ApiPublishStatus.PRIVATE,
-    }
+    publish_status = {"GET": ApiPublishStatus.PRIVATE}
     owner = ApiOwner.FOUNDATIONS
     # Disable authentication and permission requirements.
     permission_classes = ()
diff --git a/src/sentry/api/urls.py b/src/sentry/api/urls.py
index 9502e880a45e..6064c7215c7c 100644
--- a/src/sentry/api/urls.py
+++ b/src/sentry/api/urls.py
@@ -730,7 +730,7 @@
 from .endpoints.artifact_lookup import ProjectArtifactLookupEndpoint
 from .endpoints.assistant import AssistantEndpoint
 from .endpoints.auth_2fa import AuthTwoFactorChallengeEndpoint, AuthTwoFactorEndpoint
-from .endpoints.auth_config import AuthConfigEndpoint
+from .endpoints.auth_config import AuthConfigClearOrganizationEndpoint, AuthConfigEndpoint
 from .endpoints.auth_index import AuthIndexEndpoint
 from .endpoints.auth_login import AuthLoginEndpoint
 from .endpoints.auth_organization_config import AuthOrganizationConfigEndpoint
@@ -1083,6 +1083,11 @@ def create_group_urls(name_prefix: str) -> list[URLPattern | URLResolver]:
         AuthConfigEndpoint.as_view(),
         name="sentry-api-0-auth-config",
     ),
+    re_path(
+        r"^config/clear-organization/$",
+        AuthConfigClearOrganizationEndpoint.as_view(),
+        name="sentry-api-0-auth-config-clear-organization",
+    ),
     re_path(
         r"^login/$",
         AuthLoginEndpoint.as_view(),
diff --git a/tests/sentry/api/endpoints/test_auth_config.py b/tests/sentry/api/endpoints/test_auth_config.py
index ee8c28af739b..3dca0423e82b 100644
--- a/tests/sentry/api/endpoints/test_auth_config.py
+++ b/tests/sentry/api/endpoints/test_auth_config.py
@@ -14,6 +14,21 @@
 from sentry.web.frontend.auth_login import additional_context
 
 
+@control_silo_test
+class AuthConfigClearOrganizationEndpointTest(APITestCase):
+    path = "/api/0/auth/config/clear-organization/"
+
+    def test_clear_active_organization(self) -> None:
+        session = self.client.session
+        session["activeorg"] = "previous-org"
+        session.save()
+
+        response = self.client.post(self.path)
+
+        assert response.status_code == 204
+        assert "activeorg" not in self.client.session
+
+
 @control_silo_test
 class AuthConfigEndpointTest(APITestCase):
     path = "/api/0/auth/config/"

From eea69bc9d39250ae1246f38d561fcf9a55863fcd Mon Sep 17 00:00:00 2001
From: "getsantry[bot]" <66042841+getsantry[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:38:15 +0000
Subject: [PATCH 2/2] :hammer_and_wrench: Sync API Urls to TypeScript

---
 static/app/utils/api/knownSentryApiUrls.generated.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/static/app/utils/api/knownSentryApiUrls.generated.ts b/static/app/utils/api/knownSentryApiUrls.generated.ts
index eefc93236ff6..fba5150f37e6 100644
--- a/static/app/utils/api/knownSentryApiUrls.generated.ts
+++ b/static/app/utils/api/knownSentryApiUrls.generated.ts
@@ -27,6 +27,7 @@ export type KnownSentryApiUrls =
   | '/auth/2fa/'
   | '/auth/2fa/challenge/'
   | '/auth/config/'
+  | '/auth/config/clear-organization/'
   | '/auth/login/'
   | '/auth/organizations/$organizationIdOrSlug/config/'
   | '/auth/recovery/'