Organizations & multi-tenancy
Everything in EncryptInvoice belongs to an organization. Every API request acts within exactly one organization, selected by the X-Organization-Id header:
X-Organization-Id: 42
How tokens bind to organizations
| Token type | Binding | X-Organization-Id behavior |
|---|---|---|
| Organization API token | Fixed to one organization at creation | Optional; if sent, must match the token's organization |
| OAuth token (user sign-in) | Follows the signed-in user | Selects any organization the user belongs to; without it, the user's primary organization is used |
Pointing a token at an organization it cannot access returns 404 — the API never reveals whether an organization exists.
Listing organizations
GET /api/v1/organizations is the entry point for organization selection:
- With a user OAuth token, it lists all organizations the user belongs to.
- With an organization API token, it returns only that token's organization.
Switching organization
There is no "switch" endpoint — just change the X-Organization-Id header on the next request. With OAuth user tokens this makes multi-organization workflows (e.g. an accountant serving several companies) possible with a single token.
Archived organizations
Archived organizations are read-only via the API: reads succeed, writes are rejected. Restore the organization in the app to write again.