Organizations and projects
An organization is a company using Summerbase, and it holds one or more projects. A project holds one product’s revenue data, and nearly every endpoint works in one project.
An API key belongs to one project, and a request made with it works in
that project. It needs no header to say so. The Summerbase-Project and
Summerbase-Organization headers are there for requests made on behalf
of a person signed in to Summerbase, who may belong to several
organizations and projects, and they name which one the request is about.
A request made with a key that sends either header naming a different
project or organization is refused with 403 and the code
outside_key_scope.
Some endpoints are about the organization or the project’s setup rather
than its revenue data, and need a person with a role in the organization.
A key’s role in its organization is the lowest there is, so a request made
with a key is refused with 403 by:
- listing and creating projects, and changing the project’s settings,
- creating organizations and changing them,
- memberships and invitations,
- creating and changing sources,
GET /v1/meandPATCH /v1/me, which are about the person a request is made as, where a key is nobody.
A key may read its own organization with GET /v1/organization.