# What are the possible attacks if someone able acquire all the organization ids

**URL:** <https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523>\
**Category:** Get Help\
**Tags:** security, vulnerability\
**Created:** [May 16, 2022, 6:27pm UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523 "2022-05-16T18:27:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruwan-gee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruwan-gee/32/37347_2.png) [@ruwan-gee](https://community.auth0.com/u/ruwan-gee)\
**Post date:** [May 16, 2022, 6:27pm UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523/1 "2022-05-16T18:27:03Z")

</div>

Hi all,  
Thanks for this nice community,  
I have following question.  
We are planning to expose public and open service, which can retrieve Auth0 organization id (e.g: org\_JYONr9aEzpCJxxxx) based on the user’s email address. What are the possible threats that we can face incase someone able retrieve the organization id ?  
is that value considered as a secret ?  
Thank you.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 17, 2022, 12:04am UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523/3 "2022-05-17T00:04:13Z")

</div>

Hi there @ruwan-gee welcome to the community!

The Org ID is similar to a Client ID in that they’re just identifiers for the client you’re using for Authentication - These aren’t necessarily confidential. In this context you are [Authenticating a user through an Organization](https://auth0.com/docs/manage-users/organizations/using-tokens#authenticate-users-through-an-organization) where both the `client_id` and `org_id` are included in the [authorize request](https://auth0.com/docs/api/authentication#login).

Hope this helps!

Hope this helps!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 1, 2022, 12:05am UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523/4 "2022-06-01T00:05:14Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.