A platform managing multiple customers cannot expose one customer's providers, resolutions, or bookings to another. This requires genuine tenant isolation — not just filtered queries.
Hierarchy
Platform account
→ Organization A
→ Provider network A
→ Resolutions, bookings, webhooks
→ Organization B
→ Provider network B
→ Resolutions, bookings, webhooks
Each organization has its own:
- Provider graph
- Ranking policies
- Calendar connections
- Resolution history
- Webhook destination
- API keys
API key types
| Type | Creates orgs | Cross-org access |
|---|---|---|
| platform_live | Yes | Yes, with Orita-Organization-Id header |
| platform_test | Yes | Yes, with Orita-Organization-Id header |
| organization_live | No | No — scoped to this org only |
| organization_test | No | No — scoped to this org only |
Creating a downstream organization
POST /api/v2/organizations
Authorization: Bearer <platform_key>
{
"externalId": "customer-org-abc",
"name": "Nova Health"
}
Operating on behalf of an org (platform key)
POST /api/v2/resolutions
Authorization: Bearer <platform_key>
Orita-Organization-Id: org_01K...
The resolution is scoped to the downstream organization. The platform key sees all its organizations; the organization key sees only itself.
Providing Orita-Organization-Id with an organization-scoped key returns 401 UNAUTHORIZED.
Cross-tenant access prevention
Every table in Orita includes both organization_id and platform_id. Every request verifies:
- Organization belongs to the authenticated platform
- Resource belongs to the requested organization
- API key scope allows the operation
Attempts to access another organization's resources return 403 FORBIDDEN regardless of key type.
Audit log
All write operations are recorded in an immutable audit log:
GET /api/v2/audit-events
Each event records actor, action, resource, request ID, and before/after summary. Sensitive values are never stored in audit events.
Organization-specific policies
Each organization can activate its own ranking policy, webhook destination, and calendar connection settings. Platform-level defaults do not override organization-level configuration.