multi-tenant-api-route

To enforce multi-tenant data isolation in Next.js API routes, apply mandatory businessId filtering to all Prisma queries. This ensures every database operation is scoped strictly to the authenticated user's business, preventing cross-tenant data access.

NextAuth getServerSession works with role-based access control by retrieving a structured user object containing roles and permissions. You apply configurable PERMISSIONS checks within your API routes to restrict access before executing Prisma database operations.

The best way to prevent cross-tenant access during updates or deletions is to implement ownership verification. You must verify the requesting user's businessId against the target record's businessId before proceeding with any GET, PUT, or DELETE operations.

Yes, you can implement soft deletes consistently across multi-tenant API endpoints. The pattern supports soft deletion alongside mandatory businessId filtering and consistent error handling to maintain data isolation without permanently removing business records.

You must include businessId on every Prisma query because it acts as the primary tenant isolation boundary. Omitting this filter exposes business data from other tenants, completely breaking the required multi-tenant security model.

Yes, this multi-tenant API routing pattern requires NextAuth. It relies specifically on the getServerSession function to authenticate users and extract the businessId necessary for enforcing mandatory tenant data isolation on your endpoints.