Manage a customer tenant

Create an isolated customer environment, bind a least-privilege key, and target it explicitly.

Required scopes: tenants:write, keys:write, domains:read · Base https://api.fatheron.dev

Steps

1. 1. Create customer tenant

   POST /v1/developer/tenants
   X-API-Key: fh_live_…
   Content-Type: application/json
   
   {
     "name": "Acme customer",
     "external_reference": "crm-42"
   }

   Keep the returned account_id. It is the explicit tenant target.

2. 2. Mint a tenant-bound key

   POST /v1/api-keys
   X-API-Key: fh_live_…
   Content-Type: application/json
   
   {
     "label": "acme-dns-reader",
     "scopes": [
       "domains:read"
     ],
     "tenant_bindings": [
       {
         "binding_type": "exact_account",
         "target_account_id": "<returned account_id>",
         "include_future": false
       }
     ]
   }

   Action scopes and tenant bindings are independent and both must allow the request.

3. 3. Call a tenant-aware endpoint

   GET /v1/domains
   X-API-Key: fh_live_…

   Send X-API-Key plus X-FH-Account: <returned account_id>. Omitting X-FH-Account uses the key owner's account.

Failure remediation

• api_key_target_not_allowed

  Bind this exact tenant to the key or use another authorized key.

• insufficient_scope

  Add the required action scope without broadening the tenant binding.

• managed_tenant_limit_reached

  Upgrade the developer package or revoke an unused tenant.

All agent recipes