The API grants access based on three headers:
- Source. Identifies the 3rd party software provider
- Org. Identifies the charity or company
- User. Identifies the user within the charity or company. This controls branch, project and field visibility, as if the user were using the web interface.