Accounting firm isolation
Every call is limited to the user’s accounting firm. A customer that belongs to another firm is reported as not found (customerNotFound), exactly like a customer that does not exist.
Creating a customer whose enterprise number another firm already registered returns 403 belongsToAnotherTenant.
See also: Errors
Confidential customers
Customers flagged as confidential are only visible to users with the Administrator access level. For other users, they are left out of lists, and so are their mandates and files. Requesting such a customer directly returns403 accessDenied.
Customer restrictions per user
The accounting firm can restrict a user to one or more of its customers. It sets this up itself, in MyCodaclean, when it creates or edits the user. The API then only returns those customers, with their mandates and files. Reading or changing another customer returns403 accessDenied.
This is typically how an end customer, rather than the accountant, uses your software: the accounting firm gives them an account restricted to their own company.