Multi-tenant

Inspow is multi-tenant: each Organization (in the code, tenant) operates in isolation. Its data (Users, Beneficiaries, Subscriptions, Plans, Invoices, Attendance Records, Meal Menus) belongs to a single organization and is never mixed with another’s.

Tenant identification

The organization is not taken from a client header, but from a verified credential. The middleware accepts two forms in Authorization:

• JWT (Bearer <token>): the tenant_id is read from the token.
• API Key (token with the ak_ prefix): the key is validated and its organization is resolved.

The subdomain can provide a hint of the slug, but on its own it gives no access: without a valid credential there is no tenant_id.

Caution

Don’t rely on an X-Tenant-ID-style header: the backend ignores it on purpose for security. The organization always comes from the JWT or the API Key.

Organization statuses

Access depends on the organization’s status (status):

Status	Value	API access
Trial	trial	Allowed while the period hasn’t expired; expired → HTTP 402 (SAAS_ACCOUNT_LOCKED)
Active	active	Allowed
Suspended	suspended	Blocked: HTTP 402 (SAAS_ACCOUNT_LOCKED) if the pause is due to the account’s payment; HTTP 503 in other cases
Closed	closed	Permanently blocked (HTTP 403)

A new organization starts in trial with a 14-day trial; when it expires, the API responds 402 until the account settles its Plan.

By sector

The organization type is defined by the vertical field. In the API, the people served are always beneficiaries (beneficiaries); what changes is how the app calls them:

• Gym (gym): Members
• School (school): Beneficiaries
• Academy (academy): Students
• Club (club): Club members
• Coworking (coworking): Coworkers
• Clinic (clinic): Patients

Organization management

Operations on /tenants require admin:tenants (super-admin), except reading your own tenant:

Method	Path	Permission
POST	/tenants	admin:tenants
GET	/tenants	admin:tenants
GET	/tenants/:id	read:tenant-info (own tenant only)
PATCH	/tenants/:id	admin:tenants
POST	/tenants/:id/suspend	admin:tenants
POST	/tenants/:id/activate	admin:tenants
DELETE	/tenants/:id	admin:tenants (logical closure)
GET	/tenants/:id/preferences	read:tenant-preferences
PATCH	/tenants/:id/preferences	update:tenant-preferences
GET	/tenants/:id/feature-flags	read:tenant-features
PATCH	/tenants/:id/feature-flags	admin:tenants

Deletion is a logical closure: it moves the organization to closed, it doesn’t delete the data.

Implications for integrations

Tip

Your API Key is tied to a single organization. You’ll only see and modify that organization’s data; it is not possible to operate on several with the same key.

Note

Concepts such as Subscription, Plan, Automatic Renewal and Notification Channel always operate within your organization. If your organization is suspended or closed, requests will be rejected until the account is settled.