2026-11-08: access audit (Wave 5)#

• No schema change in shape. schema.gql was regenerated from the running API; it now lists the Wave 4 and Wave 5 operations that were missing from the tracked file.
• Refused for platform tokens. subscribeBookkeeper, subscribeBookkeeperDeveloperPlan, createBookkeeperSubscriptionSetupIntent, cancelBookkeeperSubscription, createBookkeeperBillingProfile, completeBookkeeperClientConnectBilling and completeClientOnboardingBilling answer Not available for platform tokens, like every other plan and billing operation. A platform company has no FinBaze plan.
• Company check on id-only operations. projectFinancials, recurringFinancials, productStock, stockAvailability, the stock document operations (postStockCount, postStockAdjustment, postStockTransfer, completeAssemblyOrder, reopenStockCount, reopenStockAdjustment, updateStockAdjustment) and the employee operations ensureEmployeeRelation and setEmployeeNetPayIban now check that the caller can reach the company that owns the id. An id of another platform's company is a 404, as everywhere else.