LearnThatStack Ace your next interview
Get Pro
Sign in
API Design · question
Question 75 of 92

How do you design a multi-tenant API so one tenant can never read another tenant's data?

expert Pro
← All API Design questions

The full answer covers the core mechanics, when this pattern wins, and the trade-offs interviewers most often probe. It includes a code sample. Read it once at your own pace, then try to recall the structure from memory before the interview. Pro also includes this question's interview lens - the likely follow-up probes and what you can say in the room.

Full answer + code samples + AI explanations

Unlock to read the complete answer for this premium question.

Browse free API Design questions → Unlock all · $10/mo
Guided practice for API Design One question at a time. Answer out loud, get graded, see what you missed.
Related concept

API security: three families of mistakes, not a top ten list

Real breaches come from missing checks, leaked fields and trusted input.

For this question · chapter 1 of 3

1/3 The route nobody gated
access controlThe route nobody gatedfamily one: a missing checkauthNroute roleobject ownerfield scopeGET /postsPOST /postsGET /admin/usersGET /users/124/ordersClient200: user 124's ordersAPIdefault-deny routesTLS 1.3API5 function levelAPI1 object level
access controlThe route nobody gatedauthNroleownerfieldsGET /postsPOST /postsGET /admin/usersGET /users/124/ordersClient200: user 124's ordersAPIdefault-deny routesTLS 1.3API5 function levelAPI1 object level

The route nobody gated

  1. Real breaches rarely come from weak cryptography, but usually from a missed check. This request carries a token for the user role, and TLS protects the request on the wire. The request is validated against a few checks : authentication and the route role first. The object owner and the field scope come next, and these checks combined secure the endpoint.
  2. TLS protects the request while it travels. The request passes all four checks and server responds with a 200. A breach is usually a missed check on the request.
  3. Authentication only says who the caller is. All three routes pass that check. But GET /admin/users needs a role check too, and it is missing.
  4. The same token carries the user role, but the admin route never checks it. The server returns 200 with 1,204 email addresses, no exploit needed. OWASP calls this broken function level authorization, API5.
  5. The endpoint GET /users/124/orders checks authentication and role, but not ownership. The role check passes any normal user, so any other user can read user 124's orders. That missing check is broken object level authorization, OWASP API1.
  6. A default-deny policy fixes the function level gap. Every route stays closed unless it is listed as open. So a route nobody remembered is a route nobody can reach.
Chapter 1 · step 1 of 6

Real breaches rarely come from weak cryptography, but usually from a missed check. This request carries a token for the user role, and TLS protects the request on the wire. The request is validated against a few checks : authentication and the route role first. The object owner and the field scope come next, and these checks combined secure the endpoint.

1 of 6 Use ← → or swipe See the concept: all 3 chapters in it

© LearnThatStack - diagrams may not be republished without permission.

Want a quick review of the fundamentals? See the API Design cheatsheet.

← Back to all API Design questions
Pro · $10/mo

74 of 92 API Design answers are in Pro.

Full answers, code samples, and AI explanations that go simpler or deeper. Cancel anytime.

  • Full answers + code
  • AI explanations, simpler or deeper
  • 1,000 AI credits / month
  • Cancel anytime
Get Pro → See plans & pricing →