Skip to content
MyCLM Developers

Organizations & entities

The model

Section titled “The model”
Provider                           e.g. "MyCLM", its own sign-in and identity provider
└── Organization                   a customer company, e.g. "Cabinet Bernard Immobilier"
    ├── Entity                     an agency, office or legal entity, e.g. "Agence Lyon 6e"
    │   ├── Group                  a team inside the entity, e.g. "Gestion locative"
    │   │   └── Group              groups can be nested
    │   └── Group
    └── Entity
Level What it is In the API
Provider An isolated MyCLM space with its own users and identity provider. Tokens are issued per provider. providerId (in GET /v1/me and in webhooks).
Organization A customer company. Roles and integrations are managed per organization. orgId, node of type organization.
Entity Where the work happens: every signature request, registered mail, contact and task belongs to an entity. Features, settings and quotas are set per entity. entityId, node of type entity.
Group A team inside an entity, to scope access (e.g. a member of a group sees the resources of that group). node of type group.

Browse the tree with GET /v1/orgs/{orgId}/nodes and manage it with the Structure endpoints.

Memberships

Section titled “Memberships”

A membership attaches a user (or the service account of an API key) to one node with one role. Permissions apply to that node and everything below it:

  • a member of the organization node with the admin role manages every entity;
  • a member of Agence Lyon 6e with the member role works in that entity only;
  • a member of the group Gestion locative sees the resources attached to that group.

New resources are attached to the node where the caller works in the target entity; that is why create calls take an entityId.

What a client can see

Section titled “What a client can see”
Client Visible
API key Its organization, from the node it is attached to, with its role. Created at the entity level, it sees that entity; at the organization level, every entity.
Partner application (machine credentials) Only the organizations it provisioned or that granted it access, with the administration scopes ∩ role of each grant.
Connected app (delegated token) What the person sees, restricted to the organizations that approved the application and where the person authorized it, with the authorized scopes.

GET /v1/me returns the effective picture: orgs[] (organizations and permissions at the organization level) and scopes[] (one per entity where the client can work, with its permissions and enabled features).