> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Partners > Give each of your own customers its own applications, and choose what it can do, where, from which addresses, and for how long. A partner is one of your own customers that calls your Lerian platform from its own systems. Access Manager gives each partner its own applications. You decide what the partner can do and in which part of a product's data. You also decide its network addresses and its validity window. ## The building blocks *** A partner is a record of your tenant. The rows after it describe what you set for a partner. | Concept | What it is | | - | - | | **Partner** | A record in your tenant that represents one of your own customers. A partner is not a tenant. | | **Partner application** | An application that belongs to one partner. A partner can have several applications. | | **Permissions** | What the partner can do: a product, its resources, and the actions on them. | | **Scope** | Where the partner can do it: one restriction per dimension of the product's scope catalog, with the values you choose. | | **Scope catalog** | The list of dimensions that a product publishes for partners, such as a participant identifier. | | **Ceiling** | The most you can give a partner in one product: the permissions of that product's editor role in your tenant, and the permissions that the product reserves for partners. | | **Partner IP allowlist** | A list of network addresses that belongs to one partner. | | **Validity window and state** | The start and end of the partner's access (`validFrom` and `validUntil`), and its state: `active` or `suspended`. | ## Products that accept partners *** You can give a partner permissions only on a product that accepts partners. A product accepts partners when it publishes a scope catalog with the partner opt-in. To see which products accept partners in your deployment, read the scope catalogs with [List scope catalogs](https://docs.lerian.studio/en/reference/platform/access-manager/list-scope-catalogs.md). A product accepts partners when its entry has `partners: true`. A product without an entry has not published a scope catalog. In the Console, the **Products** step of the new partner page shows the products that do not accept partners as unavailable. Each product has its own page with its restrictions, the fields where the partner names its items, and the refusals it receives: * [Partners in Midaz](https://docs.lerian.studio/en/platform/access-manager/features/partners/midaz.md) * [Partners in Pix JD](https://docs.lerian.studio/en/platform/access-manager/features/partners/pix-jd.md) ## What you need to know *** * Each product sets its own dimensions in its scope catalog. The catalog says if a dimension is required, and if it takes more than one value. * **A partner with permissions in a product that declares dimensions needs a scope there.** Give it at least one scope entry for that product. Without one, Access Manager refuses to create or change the partner, with `400` and `IDE-1060`. A partner saved before this rule, without a scope entry, is refused with `403` on every request to that product until you add one. * The exception is a permission entry that holds only permissions that the product reserves for partners. Such an entry needs no scope, and it applies to the whole tenant. In Pix JD, these are [JD's channel permissions](https://docs.lerian.studio/en/platform/access-manager/features/partners/pix-jd.md#jd-as-a-partner). * When a product marks a dimension as required, a partner with permissions on that product needs a scope entry for it. Without it, Access Manager refuses the partner with `IDE-0001`. * Outside an entry of reserved permissions, a partner reaches only what its permissions **and** its scope both allow. * Access Manager does not check that scope values exist in the product. It stores the values you enter. Copy them from the product's own API or Console. * You cannot delete a partner that has applications. Delete its applications first. * Access Manager refuses a permission above the ceiling with `IDE-1043`. The Console marks it as **Not allowed**. ## How a request is decided *** Every request that a partner's application sends to a product is checked against the partner's record, in this order. The first check that fails decides the answer: 1. **Network address.** The caller's address is checked against the partner's own IP list, or your tenant's list when the partner has none. 2. **State.** The partner must be `active`. 3. **Validity window.** The request must be inside the partner's validity window. 4. **Permissions.** The product, the resource, and the action must be in the partner's permissions. 5. **Scope.** The items that the request names must be inside the partner's scope. A permission that the product reserves for partners skips this check. The last two checks give the same answer, so a partner cannot use a refusal to learn which items exist outside its scope. The first three checks also apply when the partner requests a token. Each product page lists the codes the partner receives. ## When a change applies *** Every change you make to a partner applies without a new token: its permissions, its scope, its state, its validity window, and its IP list. ## Next steps *** > [card] [Manage partners in the Console](https://docs.lerian.studio/en/platform/access-manager/features/partners/console.md) > > Create a partner step by step, create its applications, suspend it, or delete it. > [card] [Manage partners via API](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md) > > The partner operations, their fields, examples, and error codes. > [card] [Partners in Midaz](https://docs.lerian.studio/en/platform/access-manager/features/partners/midaz.md) > > Confine a partner to one organization and to its ledgers, accounts, or routes. > [card] [Partners in Pix JD](https://docs.lerian.studio/en/platform/access-manager/features/partners/pix-jd.md) > > Confine a partner to a direct participant or to one indirect participant. > [card] [IP allowlist](https://docs.lerian.studio/en/platform/access-manager/features/ip-allowlist/overview) > > Your tenant's list of trusted network addresses. > [card] [Error list](https://docs.lerian.studio/en/reference/platform/access-manager/access-manager-error-list.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.