Auth: document or align cross-tenant response codes (404 vs 403)

[CryptoJones]

Summary

Cross-tenant access handling is inconsistent:

• Single-row GET/PATCH/DELETE → 404 (secure enumeration defense)
• listByCompany with wrong company → 403

Both may be intentional, but SDK clients need clarity.

Options

1. Document the distinction in OpenAPI/README (list vs probe semantics)
2. Align list endpoints to 404 where enumeration is a concern

Acceptance criteria

• Decision documented in OpenAPI
• Behavior consistent or explicitly differentiated with rationale

Source

Code review backlog (2026-06-23)