Multi-tenancy

The API resolves every Partners API collection request to one Basker organization, called a tenant. The service adds the correct data constraint automatically. You do not need to include a tenant field in your filters.

Resolve the tenant

Every URL contains a tenant slug:

/partners/{version}/{tenant}/{collection}

You can override that path value with one of the tenant headers. Resolution follows this order:

The first supplied value that resolves successfully determines the tenant. A header therefore takes precedence over a different slug in the URL.

For straightforward integrations, keep the path slug and any slug header identical:

curl -s \
  -H "Authorization: users API-Key YOUR_API_KEY" \
  -H "x-basker-tenant-slug: remarkable-theatre" \
  "https://api.basker.app/partners/2026-02/remarkable-theatre/events"

An unknown tenant returns 404. Authentication and tenant resolution are separate. A valid tenant does not make an invalid API key acceptable.

Automatic data scoping

Once the API resolves the tenant, it applies these rules:

• The API limits a list or single-record read to records visible to that tenant.
• A create request associates the new record with that tenant.
• An update or delete succeeds only for a record owned by that tenant.
• The API removes the internal tenant field from returned records.

Tenant groups and shared data

Some organizations belong to a tenant group so they can share selected collections. Read access follows the sharing mode configured for each collection:

• Global: every group member can read every member's records in that collection.
• Shareable: a tenant reads its own records plus records explicitly shared with it.

REST and GraphQL reads use the same group-aware boundary. Relationships and configured custom-object fields can link to a shared record and resolve it normally.

Writes are never widened to the group. You may read and link another member's shared record, but you cannot update or delete it. A write to a readable record owned by another member returns 404.

To narrow a group-shared collection to one member, add its tenant ID to where:

curl -s -G \
  -H "Authorization: users API-Key YOUR_API_KEY" \
  --data-urlencode 'where[tenant][equals]=000000000000000000000006' \
  "https://api.basker.app/partners/2026-02/remarkable-theatre/events"

The API combines that filter with the existing group boundary, so it cannot expose records outside the group.

If an expected shared record is missing, confirm that the organizations are in the same group. Also confirm that the collection is global or the record has been explicitly shared.

Related

• Authentication
• Filtering
• Response format