:::endpoint POST /v1/auth/token/workspace

The step after [signing in](/docs/api/apps/sign-in) without an environment, when
the password was right for accounts in more than one. Answers exactly as signing
in does: a token, or a two-factor challenge for the chosen account.

## Request

```bash
curl https://api.proppertrading.com/v1/auth/token/workspace \
  -H "Content-Type: application/json" \
  -d '{
    "choice": "5d0c3f2e9a7b4c1d8e6f0a2b4c6d8e1f3a5b7c9d0e2f4a6b8c1d3e5f7a9b0c2d",
    "workspace": "acmefunded"
  }'
```

| Field       | Type   | Description                                              |
| ----------- | ------ | -------------------------------------------------------- |
| `choice`    | string | From the sign-in response. Required                      |
| `workspace` | string | The `id` of one of the environments offered. Required    |

Who is signing in, which scopes and which device all come from the choice. This
request only says where.

## Response

The same two responses as [signing in](/docs/api/apps/sign-in): `signed_in` with
a token, or `two_factor_required` with a challenge for
[the second step](/docs/api/apps/two-factor).

## The choice is used once

Picking one spends it, whatever happens next. A wrong code at the second step
goes back to the password, as it always has. Picking an environment that was not
offered does not spend it, so the same choice can be sent again with one that
was. It expires on its own after five minutes.

## Errors

| Status | Code                        | Meaning                                                   |
| ------ | --------------------------- | --------------------------------------------------------- |
| 400    | `workspace_not_found`       | Not one of the environments that were offered             |
| 401    | `expired_workspace_choice`  | Expired or already used. Start again from the password    |
| 401    | `account_deactivated`       | The chosen account has been switched off                  |
| 403    | `admin_access_required`     | Signing in to the Propper app with an account that does not help run the environment |
| 403    | `two_factor_setup_required` | The firm requires two-factor and this account has none    |
| 403    | `block_anonymizer`          | The firm blocks VPN, proxy and Tor connections            |
| 403    | `block_country`             | The firm blocks connections from this country             |
| 422    | `validation_failed`         | A field is missing or malformed                           |
| 429    | `rate_limit_exceeded`       | Shares the limit of the two-factor step                   |
| 503    | `tenant_in_maintenance`     | The firm is closed for maintenance                        |