Access model
Who can read or write which record. One formula covers every endpoint.
The formula
effective permission = (the actor's role on the record) ∩ (the token's scopes)
The actor is either a Wefunder user who authorized your app, or an installation of your app on a company or syndicate. The role supplies what that actor may do: what a company editor can see, what a syndicate manager can change. Scopes are a ceiling and only subtract: a token granted read:investments can read investments and nothing else, even if the person behind it could cancel one on the website.
There is no organization in that formula. Your organization owns the app; it does not partition the data.
Three kinds of token
| Token | Acts as | Reaches |
|---|---|---|
User-authorized (authorization_code) | The person who consented | What that person can see or do, within the granted scopes |
Installation token (POST /installations) | The company or syndicate the app is installed on | That one company or syndicate, within the installation's scopes |
Server key (client_credentials) | No one | Public data only: read:public |
Filters narrow, never widen
A query parameter such as company_id selects within what the token can already see. Filtering GET /investments on a company you do not edit returns only your own investments there, not the company's.
Visibility is separate from access
A company can be private, published on wefunder.com, or published to a syndicate. Publication decides where a record is discoverable; it never grants your app access to it. The /explore catalog is the set of offerings Wefunder publishes to the marketplace, which is why a server key can read it.
In practice
- To read a founder's investments, either the founder authorizes your app or installs it on the company. See Installations.
- To run a syndicate from your tools, a syndicate manager authorizes your app or installs it on the syndicate. See the Syndicate API.
- To show an investor their portfolio, the investor authorizes your app with
read:investments. See Portfolio. - Writes that carry legal or financial weight are proposed as intents and approved by a human.