Tenancy

OLIFY isolates tenant data by tenant GUID. Send the Olify-Tenant-Id header on every tenant-scoped request:

Olify-Tenant-Id: {tenant_id}

OLIFY issues a tenant GUID with your service account credentials. The access token must contain an olify_tenant_id claim authorizing that service account for the selected tenant.

Tenant-scoped operations

Most application-data operations are tenant-scoped. Always send a tenant GUID when the operation lists Olify-Tenant-Id as a header parameter. Directory token and tenant-discovery operations are not tenant-scoped; they only need the Bearer token.

GET https://api.olify.io/assets?$top=10
Authorization: Bearer {access_token}
Olify-Tenant-Id: 11111111-1111-1111-1111-111111111111
Accept: application/json

Discover available tenants

Use the Directory operation below to list the tenants the authenticated service account may enter:

GET https://api.olify.io/directory/directory-users/available-tenants
Authorization: Bearer {access_token}
Accept: application/json

curl -sS 'https://api.olify.io/directory/directory-users/available-tenants' \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Accept: application/json'

Use the applicable tenant GUID from the response as the Olify-Tenant-Id value on tenant-scoped requests.

Header behavior

An omitted, empty, or whitespace-only header does not select a tenant. Send a valid tenant GUID on every tenant-scoped request.

Tenant authorization failures

The following values return HTTP 403 with error set to AuthorizationException:

• A value that is not a GUID
• Multiple Olify-Tenant-Id header values
• A well-formed tenant GUID that the service account is not authorized to enter

A valid access token does not grant access to every tenant. Authorization succeeds only when its olify_tenant_id claims include the selected tenant.

These tenant selection failures return 403, not 400. See Errors for the response format.

Select the tenant exclusively with the Olify-Tenant-Id header.