Skip to main content

Tenants

AgencyMax is a multi-tenant SaaS platform, and each agency is a tenant. Tenants are fully isolated from one another. A request can only read or change data belonging to the tenant in its URL.

Tenant identifier​

Each tenant has a short, URL-safe tenant identifier, such as acme. It's the first segment of every tenant-scoped resource path:

GET /agency-management/{tenantIdentifier}/agents
GET /agent-onboarding/{tenantIdentifier}/applications
GET /identity-management/{tenantIdentifier}/users

Your AgencyMax representative will give you your tenant identifier.

How tenant access is enforced​

  1. The API resolves the tenant from the route. If the identifier is unknown, the request fails with 404 Not Found.
  2. The API checks that the access token contains the scope tenant:<tenantIdentifier> for the same tenant. If it doesn't, the request fails with 403 Forbidden.
  3. The operation's API scope is checked.
  4. All data access is limited to that tenant.

Tenant-specific configuration​

Some behavior can be configured per tenant, so different agencies may see different results for the same request. Examples:

  • The maximum page size for Agency Management list operations. See Pagination.
  • Whether agent codes are generated from the agency's own pool or from a master agency. See Agents.
  • The default status of new Identity Management users.
  • Which fields the Agent Onboarding app collects and requires. See Submission validation.
  • The identity provider (authority) that issues the tenant's tokens.

Integrating with multiple tenants​

If you integrate with more than one agency, such as a partner serving several agencies:

  • Get a separate token for each tenant, each with its own tenant:<id> scope, unless AgencyMax has explicitly set up your client for multi-tenant tokens.
  • Cache tokens per tenant.
  • Keep each tenant's data separate in your system, and never build a URL for one tenant from another tenant's data.