Skip to main content

Workflow API Tenant Context

Summary​

The API resolves a numeric tenant from recognized identity claims or request metadata. Mutations require tenant context; many reads rely on global query filters.

Required tenant behavior​

Definition mutations, instance start and task actions call RequireTenantId. Missing context raises a tenant-related exception translated by middleware into a bad-request message.

Filtered read behavior​

Definition, instance, task, audit and timeline entities use global filters. Missing context normally scopes filtered reads to the context’s zero fallback rather than failing. A recognized super-administrator role bypasses filters.

Unfiltered operational data​

Outbox and processed-event records do not share the canonical tenant global filter. The exposed outbox projection is therefore not tenant-isolated by the DbContext.

Trust boundary​

Request metadata can supply tenant, email and roles without a route authentication requirement.

Requires Confirmation​

Trusted metadata injection, super-administrator governance, outbox isolation and uniform missing-tenant behavior require confirmation.

Source References​

  • microservices/src/workflow-service/Application/Common/Abstractions.cs
  • microservices/src/workflow-service/Infrastructure/Persistence.cs
  • microservices/src/workflow-service/Infrastructure/WorkflowDbContext.cs
  • microservices/src/workflow-service/Program.cs

See Also​

Keywords​

Workflow API, approval endpoint, Workflow Service.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20