# Subjects and resource ownership

> Understand creator and agency API subjects, ownership boundaries, and tenant-safe resource access.
>
> Canonical URL: https://docs.creatorsjet.com/api/ownership

Every Public API key acts as one subject: a creator or an agency. The subject is fixed when the key is created and is returned by `GET /me`.

```json
{
  "data": {
    "subject_type": "creator",
    "subject_id": "66b0f51d46071dc43b2db101",
    "user_id": "66b0f51d46071dc43b2db102",
    "scopes": ["profile:read", "campaigns:read"],
    "entitlement": "active"
  },
  "request_id": "50c20a47-bf9a-4dfa-98ae-54fd89a172e1"
}
```

Do not treat `user_id` and `subject_id` as interchangeable. Creator resources are owned by the creator record identified by `subject_id`; agency resources are owned by the agency identified by `subject_id`.

## Ownership matrix

| Resource        | Creator key                                         | Agency key                                                   |
| --------------- | --------------------------------------------------- | ------------------------------------------------------------ |
| Creator profile | The creator subject only                            | Creators currently in the agency roster                      |
| Creator import  | Not available                                       | Imports started by the agency                                |
| Media kit       | Personal kits without an agency owner               | Kits owned by the agency for its roster creators             |
| Link in bio     | The creator subject's single page                   | Not available                                                |
| Pitch deck      | Not available                                       | Decks owned by the agency                                    |
| Campaign        | Campaigns owned by the creator                      | Campaigns owned by the agency                                |
| Analytics       | Owned media kits, link in bio, and campaign reports | Owned media kits, public roster, decks, and campaign reports |

For agency media-kit operations, `creator_id` selects a creator already in the agency roster. It does not transfer ownership of another agency's kit or create a cross-agency relationship.

For creator media-kit operations, omit `creator_id`. The API infers the creator from the key and rejects attempts to select a different creator.

## Tenant-safe lookups

Ownership is part of the database query for resource reads and writes. A resource that does not exist and a resource owned by another subject both return `404 NOT_FOUND`.

This behavior applies to opaque resource IDs. It prevents callers from using response differences to discover whether another account owns a creator, import, media kit, deck, or campaign.

## Integration guidance

* Persist the `subject_id` alongside the API-key configuration in your system.
* Do not accept arbitrary resource IDs from an untrusted client and pass them to the API without authorization in your own application.
* Store IDs as opaque strings; do not derive ownership or resource type from their format.
* Use separate keys when one integration needs agency access and another needs creator access.
* Re-run `GET /me` after rotating credentials or changing the connected CreatorsJet account.

> **Info — A scope does not change ownership:**
>
> A write scope permits an operation only within the key's subject. It never grants access to another creator or agency.