title: REST API multi-tenant security
body: <p>I have a question about RESTful APIs and security in a multi-tenant environment.</p>
  
  <p>Imagine you have an endpoint: <code>api/branches/:branchId/accounts/:accountId</code></p>
  
  <p>Authentication is done through <strong>Bearer Tokens (oauth2)</strong>. Each token includes a set of claims associated to the invoking user. A <code>branchId</code> claim is included in the token, and each user belongs to a single branch.</p>
  
  <p>The security restrictions are the following:</p>
  
  <ol>
  <li>The branchId of the GET request should match the one stored on the token claim.</li>
  <li>accountId should be a valid account inside the branch identified by <code>branchId</code>.</li>
  </ol>
  
  <p>The question is: which of the following solutions is correct?</p>
  
  <ol>
  <li>Maintain the endpoint: <code>api/branches/:branchId/accounts/:accountId</code>. And do the required security checks. </li>
  <li>Change the endpoint to: <code>api/accounts/:accountId</code>, obtain the branchId from the token, and then do the remaining security checks. </li>
  </ol>
  
  <p>The application is meant to be multi-tenant. Each branch is a tenant, and each user may only access the information associated with its single branch. 
  Thanks!</p>