All routes tenant-scoped unless noted: each request acts on the one organization named in X-Tenant, which must be one of the caller's own registered organizations. Nothing here lists or reaches other tenants.
Tenant settings
| Method & Path | Permission | Purpose | Side effects |
|---|---|---|---|
GET tenant | — | Active tenant profile + effective permissions | — |
PATCH tenant | tenant.manage (+tenant.security.manage for MFA-policy fields) | Update org profile | 202 — opens an email-OTP change request, not applied immediately |
GET tenant/numbering-settings | tenant.view | Effective per-doc-type numbering prefix/padding | — |
PUT tenant/numbering-settings | tenant.manage | Update numbering prefixes/padding | Rejects if the series already issued numbers; audit |
GET tenant/collection-settings | tenant.view | WHT recognition mode, receipt issuance, payment methods | — |
PUT tenant/collection-settings | tenant.manage | Update collection settings | Locks wht_recognition once the WHT control account has ledger activity; audit |
POST tenant/logo | tenant.manage | Upload org logo | Stores file, deletes prior, audit |
GET tenant/tax-pack | tenant.manage | Preview effect of applying a country tax pack | — |
POST tenant/tax-pack/apply | tenant.manage | Apply country tax pack | Creates/updates tenant tax rates |
GET tenant/tax-registrations | tenant.view | Tax registration profile per tax type | — |
PUT tenant/tax-registrations | tenant.manage | Upsert one tax type's registration | Drives which statutory forms apply; audit |
Change requests (email-OTP confirmation)
| Method & Path | Permission | Purpose |
|---|---|---|
POST change-requests/{changeRequest}/confirm | matches the underlying resource (tenant.manage/branch.manage/period.manage) | Confirm a pending OTP-gated change with the emailed code |
Branches
| Method & Path | Permission | Purpose | Side effects |
|---|---|---|---|
GET branches | branch.view | List branches | — |
POST branches | branch.manage | Create branch | No plan cap (branches are unlimited); 202 change request |
PATCH branches/{branch} | branch.manage | Update branch | Never plan-capped; 202 change request |
Departments / Cost Centers / Projects (feature:dimensions)
Same CRUD shape (GET/POST/PATCH) for departments, cost-centers, projects — permission org.view/org.manage, each write audited.
Members & Access (RBAC)
| Method & Path | Permission | Purpose | Side effects |
|---|---|---|---|
GET members | member.view | List tenant members | — |
POST members | member.invite | Invite a member by email + role/permissions | Seat-capacity + privilege-ceiling checks; creates user if new; sends invite email; audit member.invited |
POST members/{membership}/resend-invite | member.invite | Resend invitation | New token, sends email, audit |
PATCH members/{membership}/roles | member.manage | Reassign roles | Privilege-ceiling + self-lockout guards; clears overrides; audit |
PATCH members/{membership}/permissions | member.manage + feature:advanced_rbac | Set per-member permission overrides | Privilege-ceiling + self-lockout guards; audit |
POST members/{membership}/reactivate | member.manage | Reactivate a suspended member | Re-checks seat cap; audit |
POST members/{membership}/transfer-ownership | owner-only + password confirm | Transfer tenant ownership | Old owner keeps Administrator role; audit |
DELETE members/{membership} | member.manage | Remove member access (suspend) | Audit |
Reference/meta data
| Method & Path | Permission | Purpose |
|---|---|---|
GET meta/permissions | member.view | Permission catalogue for admin UI |
GET meta/tiers | member.view | Module access-tier matrix + role presets |
GET meta/roles | member.view | Roles in active tenant |
GET meta/tax-rates | — | Active tax rates (form dropdowns) |
GET meta/country-catalogs | — | Country-specific code catalogues |
GET meta/account-subtypes | coa.view | Suggested account subtypes |