Providers
A provider is the top-level tenant in Customer Connect. It represents the service provider using Customer Connect to deliver connectivity to their own customers.
What a provider owns
Every other Customer Connect resource (customers, locations, connectors, applications, models, access policies) is either directly or transitively scoped to a single provider. That means authorization decisions ultimately anchor on the provider: read access to a provider implies read access to everything underneath it.
A provider can own locations in two ways: indirectly through one of its customers, or directly at the provider level (see Locations on the provider). Either path produces ordinary locations that host connectors, applications, and participate in access policies in exactly the same way.
Fields
| Field | Description | Example |
|---|---|---|
id | Unique ID assigned at create time | 8b14d4f9-3a52-4b91-8e7c-d3e44b5c1f2a |
networkId | NetFoundry network the provider provisions against — set on create, immutable | 7a37ee2b-9c1d-4f2e-b8a3-2d5b6e7f8c91 |
organizationId | NetFoundry organization the provider belongs to — set on create, immutable | 4a2b1c8d-6e7f-4a3b-9c1d-2e3f4a5b6c7d |
name | Human-readable display name, unique across non-deleted providers (1–255 chars) | Acme Networks |
ownerIdentityId | Identity that owns the provider | c0ffee00-1111-2222-3333-444455556666 |
createdBy, createdAt, updatedAt, deletedAt, deletedBy | Standard lifecycle fields |
The brandingId link to a Branding sub-resource is managed via
/providers/{id}/branding and is not exposed directly on the provider response.
Providers and networks
A provider is bound to exactly one NetFoundry network at creation time. Every resource beneath the provider is provisioned on that network, and providers in different networks are fully isolated from each other.
Authorization
Customer Connect gates most operations at the provider level: a caller with read on a provider can read every
customer, location, connector, and application beneath it. update on the provider is the gate for mutating its
descendants.
Branding
A provider may have an optional Branding (a logo and color palette) managed as a singular
sub-resource at /providers/{id}/branding. Branding is never independently permissioned; anyone with update on the
provider can create, replace, patch, or delete it.
Locations on the provider
A provider can host its own locations directly, without an intervening customer. This is the natural home for provider-owned infrastructure (internal gateways, shared egress points, lab connectors, monitoring probes) where a tenant customer would be artificial.
Provider-level locations are ordinary Locations and behave the same as customer Locations:
- They host Connectors, and those connectors host Applications exactly as on a customer location.
- They can participate in access policies on either side. An access policy inside the provider can reach from a provider location's connector to a customer connector, from a customer's connector to a provider location, or any combination. The only requirement is that every endpoint belongs to the same provider.
The locations and connectors counts include provider-level resources alongside customer-level ones.
Resources
A provider owns a collection of uploaded Resources. These are binary assets such as images, exposed at
/providers/{id}/resources. Resources are not independently permissioned; all access routes through the provider.
Resource counts
Every provider response includes a counts object with the number of customers, locations, and connectors scoped to
the provider. It's populated on every list and get response, so dashboards and navigation UIs can render counts
without paging through the underlying collections.