title: Rest API with multi-tenant database separated by client
body: <p>I have a multi-tenant database with the composite key</p>
  
  <pre><code>clientId - docId
  </code></pre>
  
  <p>The routing looks like this</p>
  
  <pre><code>/api/controller/clientId/docId
  </code></pre>
  
  <p>For authentication I use a "global" username such as an email + password, sent in the http-header of every request via https. The username maps explicitly to a client and is available on the backend.</p>
  
  <p>What's the way to do it properly with rest and have best security?</p>
  
  <ol>
  <li>Route like above and just verify that the clientId according to the username is the same than in the routing</li>
  </ol>
  
  <p>or</p>
  
  <ol>
  <li><p>Change the routing as below and get the clientId from a database before saving a record?</p>
  
  <p><code>/api/controller/docId</code></p></li>
  </ol>
  
  <p>This may be an obvious question, but I'm worried about potential security issues. Or is it just a no-brainer to go with the shorter routing?</p>
  
  <p>Thanks!</p>