Maybe you can help us to understand how to approach this use case: as global feature we need to create an endpoint to get the invoices (i.e. GET /invoices), this endpoint needs to be available for several countries (Italy, France, etc…) and we need to make sure each country is able to access ONLY to its invoices.
The API needs to be protected with OAuth2.0, so first step is to authenticate towards the OAuth provider (with client-id and client-secret), get the token back and use the token to invoke the API. Each country will have its pair of client-id and client-secret.
The problem is that once the API received the request (with token), it doesn't know from which user (client-id) is coming from.
How can I make sure that a country can access only its invoices? (i.e. GET endpoint /france/invoices should be available only for France, /germany/invoice should be available only for Germany, etc... )
Thanks a lot!
May be expose your API on GET /invoices and GET /invoices/{country} (where "country" can be country name or country code passed as a URI parameter). Then once you receive the request, parse the request ofr the URI Parameter, and once you know what that country name is, modify your query (assuming the invoices are stored in a DB) to pull only records for that country. If the invoices are not in a Database, and if you created a set of separate functions (flows) for each country, then in the main flow you will end up using a Choice-Router to route the requests to appropriate flow based on that country name. Although the secnd option may be really ugly since there are so many countries and your Choice Router will end up with too many paths. My 2 cents