API Design · Senior · Question 50 of 75

How should multi-tenant APIs prevent data leaks between tenants?

1Trust a tenantId query parameter
2Use separate URLs only
✓Correct answer: Derive the tenant from the authenticated identity (not from request parameters), enforce it in every query (e.g. RLS), and test cross-tenant access

Explanation

A tenant ID from the client is just another object reference that needs authorization.

Further reading

Test yourself

Take the API Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.