Tenant Handling

primaTime is a multi-tenant application where each organization operates as an isolated tenant.

What is a Tenant?

A tenant represents an organization in primaTime. Each tenant has:

• Isolated data (projects, clients, tasks, time records, etc.)
• Independent user memberships and permissions
• Separate billing and subscription settings
• Custom organization settings (timezone, currency, branding)

A user can belong to multiple organizations and switch between them.

The tenant comes from your credential

The organization a request applies to is fixed when an API key is created, or selected when a user signs in with OAuth. Either way it travels with the credential, so requests carry no tenant header:

curl -X POST https://api.next.primatime.com/graphql \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"query": "{ projects(first: 10) { edges { node { id title } } } }"}'

X-Tenant-ID is no longer supported

Sending it has no effect. To work with a different organization, use a credential belonging to it.

An API key always has one. If an OAuth access token has none, every tenant-scoped operation fails with:

Missing tenant. Tenant-scoped operations require an organization-scoped access token.

Sign in again and select an organization.

Listing your organizations

query MyOrganizations {
  authenticationContext {
    accesses(first: 50) {
      edges {
        node {
          id
          organization {
            id                    # use in the API
            authOrganizationId    # use when requesting a token
            profile {
              title
              urlPrefix
            }
          }
        }
      }
    }
  }
}

Switching organization

With an API key, create a separate key in each organization you need to reach and use whichever one applies.

With OAuth, take the target organization's authOrganizationId from the query above — not its id — request a new access token scoped to it, and use that token in the Authorization header. See Switching organization.

Working with several organizations at once

Keep a separate credential per organization rather than switching one back and forth. For OAuth this also avoids a shared refresh token being invalidated by a parallel worker, since refreshing rotates it.