Multi-tenancy
Isolation model
Section titled “Isolation model”Public operations resolve an API credential to an organization and environment before loading or writing tenant resources. Environment-bound public identifiers do not authorize access on their own; authorization and database filtering remain required.
- API keys belong to an environment and expose a set of scopes.
- Invoices, customers, series, tax rates, provider settings, documents, operations, and webhooks are environment-scoped where defined by the API.
- The issuer fiscal profile and persisted invoice snapshot establish fiscal identity; caller locale does not.
- Platform administrators and integrator users use the authenticated portal’s session-based endpoints, not the public API-key contract.
Integration responsibility
Section titled “Integration responsibility”Your application must preserve its own user/organization authorization before using its server-side Emissary credential. Do not forward a shared API key to an untrusted client.