Orgs

      Registers a new Salesforce organization or updates an existing one.            Requirements:      - sfdxAuthUrl is required (Generate using: sf org:display -u your@org.com --verbose --json)      - The connection is validated before registration      - instanceUrl is optional and will be extracted from sfdxAuthUrl if not provided            Optional fields:      - isDevHub: Mark this org as a DevHub (default: false)      - isDefault: Mark this as the default DevHub - only one org can have this set (default: false)      - metadata: Additional metadata as key-value pairs in JSON format            If an org with the same username exists, it will be updated.            For sandbox registrations without sfdxAuthUrl, use /auth/salesforce/register-sandbox-by-name instead.

      Registers a Salesforce sandbox organization using credentials from an already registered production org.            Requirements:      - The production org must be registered first using /auth/salesforce/register      - The sandbox must be created by the same user whose credentials are stored for the production org      - The system will validate the sandbox and retrieve all necessary details automatically            This endpoint is specifically for sandboxes where you don't have the sfdxAuthUrl.      Just-in-time authentication will be used when accessing the sandbox.

  Filter options:  - type: Filter by organization type (e.g., "Production", "Sandbox")  - devhub: Filter to show only DevHub organizations  - metadata: Filter by metadata key-value pairs using either format:    - Comma-separated: key1=value1,key2=value2    - JSON object: {"key1":"value1","key2":"value2"}    Response includes DevHub status, default flag, and metadata for each org.

  Updatable fields:  - isDevHub: Mark/unmark as DevHub. Marking an org as a DevHub verifies it really is one (a Dev-Hub-only ScratchOrgInfo probe) and rejects naming the actual org type if not.  - isDefault: Mark/unmark as default DevHub (enforces single default constraint)  - metadata: Update metadata key-value pairs  - sfdxAuthUrl: Replace the stored credentials. The new URL is validated and the resolved username must match the target org. On success, derived fields (instanceUrl, orgId, instanceName, organizationType) are refreshed from the validation result.  Note: Setting isDevHub=true always verifies the org is a DevHub, even without a new sfdxAuthUrl. isDefault and metadata updates skip connection validation. sfdxAuthUrl updates always validate.

    **Note**: This endpoint only works for orgs that are registered in the system.    It validates that the stored sfdxAuthUrl can still be used to authenticate.

    - `username` — a registered org, or an unregistered **scratch** pool org (resolved via the pool instance's stored auth).    - `sandboxName` — an unregistered **pool sandbox**; the parent production org is auto-resolved and the token is minted just-in-time through its connected app.    Designed for CI/CD: the token is short-lived (typically 1-2 hours) and usable directly with the CLI:    sfp org login --access-token <token> --instance-url <url>    Security: the refresh token stays on the server, tokens expire quickly, and each request mints a fresh one.

    This is a convenience endpoint for CI/CD workflows that need DevHub access.    Use the returned access token with:    sfp org login --access-token <token> --instance-url <url> --set-default-dev-hub

    Managed sandboxes use their recorded production parent unless an explicit production connection is provided.    Ambiguous sandbox names require a production connection. Repository context does not select production credentials.    Registered orgs, scratch pool instances, and unmanaged discovery retain their existing authentication paths.

        Generates a short-lived access token for a Salesforce sandbox that is NOT registered in the system.        **Important**: This endpoint is for sandboxes that are not registered as orgs.        For registered orgs (including registered sandboxes), use:        - `POST /auth/salesforce/access-token?username=<sandbox-username>` to generate access tokens        How it works:        1. Uses the registered production org's credentials to perform OAuth exchange        2. Calls the Salesforce /sandboxAuth API to get an auth code        3. Exchanges the auth code for an access token        4. Returns the access token (short-lived, typically 1-2 hours)        Requirements:        - The production org must be registered using /auth/salesforce/register first        - The sandbox must be created from the production org

        Generates a short-lived access token for a Salesforce scratch org that is NOT registered in the system.        **Important**: This endpoint is for scratch orgs that are not registered as orgs.        For registered orgs (including registered scratch orgs), use:        - `POST /auth/salesforce/access-token?username=<scratch-org-username>` to generate access tokens        How it works:        1. Queries the DevHub's ScratchOrgInfo object for the scratch org        2. Retrieves the SfdxAuthUrl__c custom field (must be populated)        3. Uses the stored refresh token to generate a fresh access token        4. Returns the access token (short-lived, typically 1-2 hours)        Requirements:        - A DevHub org must be registered using /auth/salesforce/register first        - The scratch org must have SfdxAuthUrl__c populated in its ScratchOrgInfo record        - Managed scratch orgs use their recorded owning DevHub; untracked orgs retain automatic discovery