Ownership Checks

Overview

Survanta's protected resource flows apply server-side tenant, ownership, assignment, current-association, selected-tenant, token-scope, or permission checks as appropriate. The exact entitlement rule depends on the endpoint; this page does not claim one universal owner predicate for every read.

What Is an Ownership Check?

An ownership check is a server-side validation that answers: "Does the requesting user own this data, or have they been explicitly granted permission to access it?"

If the answer is no, the request is denied — regardless of how the request was constructed or which URL was called.

Examples by User Type

Website Users

When a signed-in website user opens a plan request:

• The system confirms the request belongs to that user's account.
• If a user attempts to access a request that belongs to someone else (for example, by guessing the request number and constructing a URL), the access is denied.
• The user sees only their own requests, drafts, and notifications — never another user's.

Tenant Users

When a tenant user accesses a survey or response data:

• The system verifies the survey belongs to their tenant.
• The system verifies the user has been assigned to or has permission to access that specific survey within their tenant.
• Accessing a survey from a different tenant — even if the user knows its identifier — is denied.

Public Tokens

The three token scopes have different ownership boundaries:

• SingleSurvey/QR access is bound to one survey and can submit when the token/survey rules permit.
• TenantActiveSurveys is tenant-wide and lists eligible active portal surveys; it is not bound to one survey.
• ResponseViewer is read-only and covers all permitted surveys or one SurveyId; response details/files require current associations and enabled capabilities.

API Key Requests

When an external integration makes a request using an API key:

• The system confirms the API key is active and belongs to the relevant tenant.
• The system confirms the requested resource falls within the scopes the key was issued for.
• Requests for data outside the key's scopes or tenant are denied.

Server-Side Enforcement

For endpoints with ownership-sensitive resources, enforcement is server-side. This means:

• There is no way to bypass an ownership check by modifying a URL, changing a request header, or manipulating client-side code.
• The check uses the authenticated identity attached to the request (session cookie, JWT, API key, or viewer token) — not information provided by the client.
• Even if a user can see a resource identifier (such as a request number or survey ID), they cannot access the resource unless they are authorized to do so.

Why This Matters

Without ownership checks, a malicious actor who knows or guesses the identifier of someone else's data could access it. Survanta's ownership checks prevent this class of attack — known as Insecure Direct Object Reference (IDOR) — by validating entitlement before returning any data.

Frequently Asked Questions

What error do I see if I try to access something I don't own? Depending on the endpoint, you may receive forbidden, unauthorized, not found, or a safe business failure. Public and file routes commonly use opaque not-found/unavailable responses, but no single status is guaranteed for all resources.

Can a Tenant Admin access data belonging to individual tenant users within their tenant? Tenant Admins have elevated permissions within their own tenant, which may include visibility into user-level data where appropriate for administration. They cannot access data in other tenants.

Are ownership checks applied to file downloads too? Yes. File access is subject to the same ownership and permission checks as all other data. A user cannot download a file that belongs to a different tenant or that they do not have permission to access.