Stronger Account Isolation Across Every API Request
Every request made through Effigate's API now confirms which company account it belongs to, closing a gap that could leave some API activity unscoped.
Summary
Every request made through Effigate's API now confirms which company account it belongs to before it runs, closing a narrow gap where some API activity could run without that check.
What You Gain
Picture two companies using the Effigate API side by side: before this fix, a handful of API requests weren't fully bound to the company that made them. Now every API request — and every link between records it creates, such as adding a team to a project — carries its company account from start to finish, so it can never cross into another company's workspace.
How It Works
Account binding now applies to the entire API surface, with the only exceptions being the few actions a brand-new user genuinely needs before they belong to a company yet, like accepting an invitation.
Where to Find It
This applies automatically to every Effigate account and API integration; nothing to configure.
See what else shipped that month on the Effigate Command Center changelog, or try Effigate Command Center.