Skip to content

Tenancy & scoping

Every resource path is tenant-scoped. The server derives your tenant from your credentials and rejects any path org or facility that isn't yours — it never trusts client-supplied ids alone.

Path shape

Tenant scope is carried in the URL:

KindPath prefixUsed by
Facility-scoped/api/v1/ofctx/{org_id}/{facility_id}/…Residents, Coverage, Clinical resources
Org-scoped/api/v1/ofctx/{org_id}/…Webhook subscriptions

How it's enforced

  • The org_id in the path must match the org bound to your credentials. A mismatch returns 403.
  • The facility_id must be one your credentials were granted. An out-of-scope facility returns 403.
  • org_id selects the tenant's isolated database; facility_id scopes rows within it. Cross-facility access is explicit and capability-gated, never implicit.

Deny by default

Isolation is derived from the authenticated principal, not from the ids you put in the URL. Putting someone else's org or facility id in the path does not grant access — it's rejected before any data is touched.

Finding your ids

Your org_id and granted facility_ids are provisioned with your credentials. For the shared sandbox, use the ids shown on the sandbox page. For production, they're issued alongside your client_id.