The tenant boundary is the client, not the brand. client_id is OperatorHub's own ClientID — the same value a booking webhook carries — so rosters link to a client without any mapping in between.

No clients yet.

Add a client

Use OperatorHub's ClientID exactly. It becomes the primary key, and the per-client OperatorHub secret is named from it, so it cannot be changed later.

Act across every client, and are not a member of any. Every cross-client action they take is written to the audit log.

Add a platform admin

Lowercase ASCII, one @. The email is the identity — there is no account behind it — so an address that does not match at login is an account nobody can reach.

OperatorHub webhooks

Three endpoints for the whole platform, not per client. Each client is identified by the ClientID inside the payload, so onboarding a client is a row on the Clients tab — there is nothing to add here.

Setting these up in OperatorHub

1. Add the client on the Clients tab first, using OperatorHub's own ClientID. Posts about a client we do not hold are ignored.
2. In OperatorHub, add one webhook per Watch Model — Order (Create / Update / Delete), Customer (Update only), and LimitedAvailabilityProduct_Event (Update / Delete — we don't need Create, a departure always exists before its manifest status can change) — pasting the matching URL above into URL to your hook. They are not interchangeable; a payload arriving on the wrong endpoint is logged as model_mismatch.
3. Set Include the updated record in the payload to Yes. The event then arrives fully contained — order, customer and the departure event.
4. Set Active on test servers to No. The weekly replication copies these URLs to alpha along with that setting, so they arrive there already disabled — there are no separate dev URLs to configure.

Every response is 200, including refusals, so OperatorHub does not queue retries. A rejected post names the reason in the body and the log — there will be no errors in OperatorHub's delivery view to find.

Admin audit

Every platform-admin action against a client. This log is the control that makes cross-client access acceptable, so it is shown here rather than left for someone to remember.

Nothing recorded yet.