Secure API Access - API used by multiple User types

[mark-piller]

@Tim_Jones

I have not applied the Owner Policy rules. Do you have a handy link for me to review that?

Please see this:

How to get objects that "belong" to the logged-in user (Owner Policy explained)

As the users of your app create new things objects in the database, the use-case of retrieving data that “belongs” to the user comes up quite frequently. Whether your app users create orders, invoices, or social media posts, the mechanism for retrieving data that’s associated (i.e. belongs) to the user is important. In this recipe, I will describe the simplest and the most secure way to get the data that belongs to the currently logged-in user. Let’s review some background information first. It…

@Tim_Jones

If that isn’t done, do I need to join back to the Users table to verify ownership?

I don’t know, I don’t have a full grasp of the schema design in your app and what this would accomplish.

Regards,
Mark