Subjects and resource ownership

Every Public API key acts as one subject: a creator or an agency. The subject is fixed when the key is created and is returned by GET /me.

{
  "data": {
    "subject_type": "creator",
    "subject_id": "66b0f51d46071dc43b2db101",
    "user_id": "66b0f51d46071dc43b2db102",
    "scopes": ["profile:read", "campaigns:read"],
    "entitlement": "active"
  },
  "request_id": "50c20a47-bf9a-4dfa-98ae-54fd89a172e1"
}

Do not treat user_id and subject_id as interchangeable. Creator resources are owned by the creator record identified by subject_id; agency resources are owned by the agency identified by subject_id.

Ownership matrix

For agency media-kit operations, creator_id selects a creator already in the agency roster. It does not transfer ownership of another agency's kit or create a cross-agency relationship.

For creator media-kit operations, omit creator_id. The API infers the creator from the key and rejects attempts to select a different creator.

Tenant-safe lookups

Ownership is part of the database query for resource reads and writes. A resource that does not exist and a resource owned by another subject both return 404 NOT_FOUND.

This behavior applies to opaque resource IDs. It prevents callers from using response differences to discover whether another account owns a creator, import, media kit, deck, or campaign.

Integration guidance

• Persist the subject_id alongside the API-key configuration in your system.
• Do not accept arbitrary resource IDs from an untrusted client and pass them to the API without authorization in your own application.
• Store IDs as opaque strings; do not derive ownership or resource type from their format.
• Use separate keys when one integration needs agency access and another needs creator access.
• Re-run GET /me after rotating credentials or changing the connected CreatorsJet account.