Repository: moov-io/customers
Pull request #251 (2020-10-16 02:15:10)

Validate organization on customers endpoints


Patch:
diff --git a/pkg/customers/address.go b/pkg/customers/address.go
index ee327b4..dcf32db 100644
--- a/pkg/customers/address.go
+++ b/pkg/customers/address.go
@@ -33,13 +33,18 @@ func createCustomerAddress(logger log.Logger, repo CustomerRepository) http.Hand
 			return
 		}
 
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
 		var reqAddr address
 		if err := json.NewDecoder(r.Body).Decode(&reqAddr); err != nil {
 			moovhttp.Problem(w, err)
 			return
 		}
 
-		cust, err := repo.GetCustomer(customerID)
+		cust, err := repo.GetCustomer(customerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -73,7 +78,7 @@ func createCustomerAddress(logger log.Logger, repo CustomerRepository) http.Hand
 		}
 
 		logger.Log(fmt.Sprintf("added address for customer=%s", customerID))
-		respondWithCustomer(logger, w, customerID, requestID, repo)
+		respondWithCustomer(logger, w, customerID, organization, requestID, repo)
 	}
 }
 
@@ -85,7 +90,13 @@ func updateCustomerAddress(logger log.Logger, repo CustomerRepository) http.Hand
 		if customerID == "" || addressId == "" {
 			return
 		}
+
 		requestID := moovhttp.GetRequestID(r)
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
 		var req updateCustomerAddressRequest
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			moovhttp.Problem(w, err)
@@ -98,7 +109,7 @@ func updateCustomerAddress(logger log.Logger, repo CustomerRepository) http.Hand
 		}
 
 		if req.Type == "primary" {
-			cust, err := repo.GetCustomer(customerID)
+			cust, err := repo.GetCustomer(customerID, organization)
 			if err != nil {
 				moovhttp.Problem(w, err)
 				return
@@ -120,7 +131,7 @@ func updateCustomerAddress(logger log.Logger, repo CustomerRepository) http.Hand
 
 		logger.Log(fmt.Sprintf("updating address=%s for customer=%s", addressId, customerID))
 
-		respondWithCustomer(logger, w, customerID, requestID, repo)
+		respondWithCustomer(logger, w, customerID, organization, requestID, repo)
 	}
 }
 
diff --git a/pkg/customers/approval.go b/pkg/customers/approval.go
index e9b4543..1e15b8b 100644
--- a/pkg/customers/approval.go
+++ b/pkg/customers/approval.go
@@ -26,13 +26,18 @@ func updateCustomerStatus(logger log.Logger, repo CustomerRepository) http.Handl
 			return
 		}
 
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
 		var req client.UpdateCustomerStatus
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			moovhttp.Problem(w, err)
 			return
 		}
 
-		cust, err := repo.GetCustomer(customerID)
+		cust, err := repo.GetCustomer(customerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -48,6 +53,6 @@ func updateCustomerStatus(logger log.Logger, repo CustomerRepository) http.Handl
 		}
 
 		requestID := moovhttp.GetRequestID(r)
-		respondWithCustomer(logger, w, customerID, requestID, repo)
+		respondWithCustomer(logger, w, customerID, organization, requestID, repo)
 	}
 }
diff --git a/pkg/customers/approval_ofac.go b/pkg/customers/approval_ofac.go
index e55fd00..ad8df77 100644
--- a/pkg/customers/approval_ofac.go
+++ b/pkg/customers/approval_ofac.go
@@ -114,7 +114,12 @@ func getLatestCustomerOFACSearch(logger log.Logger, repo CustomerRepository) htt
 			return
 		}
 
-		result, err := repo.getLatestCustomerOFACSearch(customerID)
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
+		result, err := repo.getLatestCustomerOFACSearch(customerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -136,7 +141,12 @@ func refreshOFACSearch(logger log.Logger, repo CustomerRepository, ofac *OFACSea
 			return
 		}
 
-		cust, err := repo.GetCustomer(customerID)
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
+		cust, err := repo.GetCustomer(customerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -150,7 +160,7 @@ func refreshOFACSearch(logger log.Logger, repo CustomerRepository, ofac *OFACSea
 			return
 		}
 
-		result, err := repo.getLatestCustomerOFACSearch(customerID)
+		result, err := repo.getLatestCustomerOFACSearch(customerID, organization)
 		if err != nil {
 			logger.LogErrorF("error getting latest ofac search: %v", err)
 			moovhttp.Problem(w, err)
diff --git a/pkg/customers/customers.go b/pkg/customers/customers.go
index 33ea193..33aa48a 100644
--- a/pkg/customers/customers.go
+++ b/pkg/customers/customers.go
@@ -64,7 +64,12 @@ func getCustomer(logger log.Logger, repo CustomerRepository) http.HandlerFunc {
 			return
 		}
 
-		respondWithCustomer(logger, w, customerID, requestID, repo)
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
+		respondWithCustomer(logger, w, customerID, organization, requestID, repo)
 	}
 }
 
@@ -87,8 +92,8 @@ func deleteCustomer(logger log.Logger, repo CustomerRepository) func(http.Respon
 	}
 }
 
-func respondWithCustomer(logger log.Logger, w http.ResponseWriter, customerID string, requestID string, repo CustomerRepository) {
-	cust, err := repo.GetCustomer(customerID)
+func respondWithCustomer(logger log.Logger, w http.ResponseWriter, customerID, organization string, requestID string, repo CustomerRepository) {
+	cust, err := repo.GetCustomer(customerID, organization)
 	if err != nil {
 		logger.LogErrorF("getCustomer: lookup: %v", err)
 		moovhttp.Problem(w, err)
@@ -312,7 +317,7 @@ func createCustomer(logger log.Logger, repo CustomerRepository, customerSSNStora
 
 		logger.Log(fmt.Sprintf("created customer=%s", cust.CustomerID))
 
-		cust, err = repo.GetCustomer(cust.CustomerID)
+		cust, err = repo.GetCustomer(cust.CustomerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -376,7 +381,7 @@ func updateCustomer(logger log.Logger, repo CustomerRepository, customerSSNStora
 		}
 
 		logger.Log(fmt.Sprintf("updated customer=%s", cust.CustomerID))
-		cust, err = repo.GetCustomer(cust.CustomerID)
+		cust, err = repo.GetCustomer(cust.CustomerID, organization)
 		if err != nil {
 			moovhttp.Problem(w, err)
 			return
@@ -402,6 +407,11 @@ func replaceCustomerMetadata(logger log.Logger, repo CustomerRepository) http.Ha
 			moovhttp.Problem(w, err)
 			return
 		}
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
+
 		customerID, requestID := route.GetCustomerID(w, r), moovhttp.GetRequestID(r)
 		if customerID == "" {
 			return
@@ -411,12 +421,12 @@ func replaceCustomerMetadata(logger log.Logger, repo CustomerRepository) http.Ha
 			return
 		}
 
-		respondWithCustomer(logger, w, customerID, requestID, repo)
+		respondWithCustomer(logger, w, customerID, organization, requestID, repo)
 	}
 }
 
 type CustomerRepository interface {
-	GetCustomer(customerID string) (*client.Customer, error)
+	GetCustomer(customerID, organization string) (*client.Customer, error)
 	CreateCustomer(c *client.Customer, organization string) error
 	updateCustomer(c *client.Customer, organization string) error
 	updateCustomerStatus(customerID string, status client.CustomerStatus, comment string) error
@@ -430,7 +440,7 @@ type CustomerRepository interface {
 	updateCustomerAddress(customerID, addressID string, req updateCustomerAddressRequest) error
 	deleteCustomerAddress(customerID string, addressID string) error
 
-	getLatestCustomerOFACSearch(customerID string) (*client.OfacSearch, error)
+	getLatestCustomerOFACSearch(customerID, organization string) (*client.OfacSearch, error)
 	saveCustomerOFACSearch(customerID string, result client.OfacSearch) error
 }
 
@@ -632,10 +642,11 @@ func (r *sqlCustomerRepository) updateAddressesByCustomerID(tx *sql.Tx, customer
 	return nil
 }
 
-func (r *sqlCustomerRepository) GetCustomer(customerID string) (*client.Customer, error) {
+func (r *sqlCustomerRepository) GetCustomer(customerID, organization string) (*client.Customer, error) {
 	custs, err := r.searchCustomers(SearchParams{
-		Count:       1,
-		CustomerIDs: []string{customerID},
+		Count:        1,
+		CustomerIDs:  []string{customerID},
+		Organization: organization,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("getting customer: %v", err)
@@ -767,15 +778,18 @@ func (r *sqlCustomerRepository) deleteCustomerAddress(customerID string, address
 	return err
 }
 
-func (r *sqlCustomerRepository) getLatestCustomerOFACSearch(customerID string) (*client.OfacSearch, error) {
-	query := `select entity_id, blocked, sdn_name, sdn_type, percentage_match, created_at from customer_ofac_searches where customer_id = ? order by created_at desc limit 1;`
+func (r *sqlCustomerRepository) getLatestCustomerOFACSearch(customerID, organization string) (*client.OfacSearch, error) {
+	query := `select entity_id, blocked, sdn_name, sdn_type, percentage_match, cos.created_at 
+from customer_ofac_searches as cos
+inner join customers as c on c.customer_id = cos.customer_id
+where cos.customer_id = ? and c.organization = ? order by cos.created_at desc limit 1;`
 	stmt, err := r.db.Prepare(query)
 	if err != nil {
 		return nil, fmt.Errorf("getLatestCustomerOFACSearch: prepare: %v", err)
 	}
 	defer stmt.Close()
 
-	row := stmt.QueryRow(customerID)
+	row := stmt.QueryRow(customerID, organization)
 	var res client.OfacSearch
 	if err := row.Scan(&res.EntityID, &res.Blocked, &res.SdnName, &res.SdnType, &res.Match, &res.CreatedAt); err != nil {
 		if err == sql.ErrNoRows {
diff --git a/pkg/reports/router.go b/pkg/reports/router.go
index b5ee268..e25e407 100644
--- a/pkg/reports/router.go
+++ b/pkg/reports/router.go
@@ -43,6 +43,10 @@ func getCustomerAccounts(
 		accountIDsInput := r.URL.Query().Get("accountIDs")
 		accountIDsInput = strings.TrimSpace(accountIDsInput)
 		accountIDs := strings.Split(accountIDsInput, ",")
+		organization := route.GetOrganization(w, r)
+		if organization == "" {
+			return
+		}
 
 		limit := 25
 		if len(accountIDs) > limit {
@@ -59,7 +63,7 @@ func getCustomerAccounts(
 
 		results := make([]*client.ReportAccountResponse, 0)
 		for _, acc := range allAccounts {
-			cust, err := customerRepo.GetCustomer(acc.CustomerID)
+			cust, err := customerRepo.GetCustomer(acc.CustomerID, organization)
 			if err != nil {
 				logger.LogError("error getting customer", err)
 				moovhttp.Problem(w, err)


Test patch:
diff --git a/pkg/customers/address_test.go b/pkg/customers/address_test.go
index fc9f94f..0bdbcc1 100644
--- a/pkg/customers/address_test.go
+++ b/pkg/customers/address_test.go
@@ -24,7 +24,8 @@ func TestCustomers__addCustomerAddress(t *testing.T) {
 		LastName:  "Doe",
 	}
 	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(cust, "organization")
+	organization := "organization"
+	err := repo.CreateCustomer(cust, organization)
 	require.NoError(t, err)
 
 	addrPayload := address{
@@ -40,7 +41,7 @@ func TestCustomers__addCustomerAddress(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("POST", fmt.Sprintf("/customers/%s/addresses", cust.CustomerID), bytes.NewReader(payload))
-	req.Header.Set("x-organization", "test")
+	req.Header.Set("x-organization", organization)
 	req.Header.Set("x-request-id", "test")
 
 	router := mux.NewRouter()
@@ -69,6 +70,7 @@ func TestCustomers__addCustomerAddress(t *testing.T) {
 	payload, err = json.Marshal(addrPayload)
 	require.NoError(t, err)
 	req = httptest.NewRequest("POST", fmt.Sprintf("/customers/%s/addresses", cust.CustomerID), bytes.NewReader(payload))
+	req.Header.Set("x-organization", organization)
 	router.ServeHTTP(w, req)
 	require.Equal(t, http.StatusBadRequest, w.Code)
 	var errResp struct {
@@ -87,7 +89,8 @@ func TestCustomers__updateCustomerAddress(t *testing.T) {
 		LastName:  "Doe",
 	}
 	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(cust, "organization")
+	organization := "organization"
+	err := repo.CreateCustomer(cust, organization)
 	require.NoError(t, err)
 
 	addrRequests := []address{
@@ -110,7 +113,7 @@ func TestCustomers__updateCustomerAddress(t *testing.T) {
 	}
 	for _, req := range addrRequests {
 		require.NoError(t, repo.addCustomerAddress(cust.CustomerID, req))
-		cust, err = repo.GetCustomer(cust.CustomerID) // refresh customer object after updating address
+		cust, err = repo.GetCustomer(cust.CustomerID, organization) // refresh customer object after updating address
 		require.NoError(t, err)
 	}
 
@@ -146,7 +149,7 @@ func TestCustomers__updateCustomerAddress(t *testing.T) {
 	req, err := http.NewRequest("PUT", url, bytes.NewReader(payload))
 	require.NoError(t, err)
 
-	req.Header.Set("x-organization", "test")
+	req.Header.Set("x-organization", organization)
 	req.Header.Set("x-request-id", "test")
 
 	res := httptest.NewRecorder()
@@ -182,6 +185,7 @@ func TestCustomers__updateCustomerAddress(t *testing.T) {
 	url = fmt.Sprintf("/customers/%s/addresses/%s", cust.CustomerID, secondaryAddressID)
 
 	req, err = http.NewRequest("PUT", url, bytes.NewReader(payload))
+	req.Header.Set("x-organization", organization)
 	require.NoError(t, err)
 	router.ServeHTTP(res, req)
 	require.Equal(t, http.StatusBadRequest, res.Code)
@@ -201,7 +205,8 @@ func TestCustomers__deleteCustomerAddress(t *testing.T) {
 		LastName:  "Doe",
 	}
 	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(cust, "organization")
+	organization := "organization"
+	err := repo.CreateCustomer(cust, organization)
 	require.NoError(t, err)
 
 	address := address{
@@ -214,7 +219,7 @@ func TestCustomers__deleteCustomerAddress(t *testing.T) {
 	}
 	require.NoError(t, repo.addCustomerAddress(cust.CustomerID, address))
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 	addressID := cust.Addresses[0].AddressID
 
@@ -224,14 +229,14 @@ func TestCustomers__deleteCustomerAddress(t *testing.T) {
 	url := fmt.Sprintf("/customers/%s/addresses/%s", cust.CustomerID, addressID)
 	req, err := http.NewRequest("DELETE", url, nil)
 	require.NoError(t, err)
-	req.Header.Set("x-organization", "test")
+	req.Header.Set("x-organization", organization)
 	req.Header.Set("x-request-id", "test")
 
 	res := httptest.NewRecorder()
 	router.ServeHTTP(res, req)
 	require.Equal(t, http.StatusNoContent, res.Code)
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 	require.Empty(t, cust.Addresses)
 }
@@ -268,7 +273,8 @@ func TestCustomerRepository__updateCustomerAddress(t *testing.T) {
 		LastName:  "Doe",
 	}
 	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(cust, "organization")
+	organization := "organization"
+	err := repo.CreateCustomer(cust, organization)
 	require.NoError(t, err)
 
 	addrRequest := address{
@@ -281,7 +287,7 @@ func TestCustomerRepository__updateCustomerAddress(t *testing.T) {
 	}
 	require.NoError(t, repo.addCustomerAddress(cust.CustomerID, addrRequest))
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 
 	addressID := cust.Addresses[0].AddressID
@@ -299,7 +305,7 @@ func TestCustomerRepository__updateCustomerAddress(t *testing.T) {
 	err = repo.updateCustomerAddress(cust.CustomerID, addressID, updateReq)
 	require.NoError(t, err)
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 
 	require.Len(t, cust.Addresses, 1)
@@ -327,7 +333,8 @@ func TestCustomerRepository__deleteCustomerAddress(t *testing.T) {
 		LastName:  "Doe",
 	}
 	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(cust, "organization")
+	organization := "organization"
+	err := repo.CreateCustomer(cust, organization)
 	require.NoError(t, err)
 
 	address := address{
@@ -340,14 +347,14 @@ func TestCustomerRepository__deleteCustomerAddress(t *testing.T) {
 	}
 	require.NoError(t, repo.addCustomerAddress(cust.CustomerID, address))
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 
 	addressID := cust.Addresses[0].AddressID
 	err = repo.deleteCustomerAddress(cust.CustomerID, addressID)
 	require.NoError(t, err)
 
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	require.NoError(t, err)
 
 	require.Len(t, cust.Addresses, 0)
diff --git a/pkg/customers/approval_ofac_test.go b/pkg/customers/approval_ofac_test.go
index 4fd8535..bb21ec2 100644
--- a/pkg/customers/approval_ofac_test.go
+++ b/pkg/customers/approval_ofac_test.go
@@ -54,10 +54,21 @@ func TestOFACSearcher__storeCustomerOFACSearch(t *testing.T) {
 	searcher := createTestOFACSearcher(repo, ofacClient)
 
 	customerID := base.ID()
+	organization := "organization"
+	customerRequest := customerRequest{
+		CustomerID: customerID,
+		FirstName:  "Jane",
+		LastName:   "Doe",
+	}
+	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
+	if err := repo.CreateCustomer(cust, organization); err != nil {
+		t.Fatal(err)
+	}
+
 	if err := searcher.storeCustomerOFACSearch(&client.Customer{CustomerID: customerID}, "requestID"); err != nil {
 		t.Fatal(err)
 	}
-	res, err := repo.getLatestCustomerOFACSearch(customerID)
+	res, err := repo.getLatestCustomerOFACSearch(customerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -91,10 +102,22 @@ func TestOFACApproval__getLatest(t *testing.T) {
 		},
 	}
 
+	organization := "organization"
+	customerRequest := customerRequest{
+		CustomerID: customerID,
+		FirstName:  "Jane",
+		LastName:   "Doe",
+	}
+	cust, _, _ := customerRequest.asCustomer(testCustomerSSNStorage(t))
+	if err := repo.CreateCustomer(cust, organization); err != nil {
+		t.Fatal(err)
+	}
+
 	AddOFACRoutes(logger, router, repo, nil)
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("GET", fmt.Sprintf("/customers/%s/ofac", customerID), nil)
+	req.Header.Set("X-Organization", organization)
 	router.ServeHTTP(w, req)
 	w.Flush()
 
@@ -119,6 +142,7 @@ func TestOFACApproval__refresh(t *testing.T) {
 	router := mux.NewRouter()
 
 	customerID := base.ID()
+	organization := "organization"
 
 	repo := &testCustomerRepository{
 		customer: &client.Customer{
@@ -139,6 +163,7 @@ func TestOFACApproval__refresh(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("PUT", fmt.Sprintf("/customers/%s/refresh/ofac", customerID), nil)
+	req.Header.Set("x-organization", organization)
 	router.ServeHTTP(w, req)
 	w.Flush()
 
diff --git a/pkg/customers/customer_search_scope_test.go b/pkg/customers/customer_search_scope_test.go
index 1286399..8165cd0 100644
--- a/pkg/customers/customer_search_scope_test.go
+++ b/pkg/customers/customer_search_scope_test.go
@@ -29,12 +29,12 @@ func Setup(t *testing.T) Scope {
 	}
 }
 
-func (scope *Scope) GetCustomers(query string) ([]*client.Customer, error) {
+func (scope *Scope) GetCustomers(query, organization string) ([]*client.Customer, error) {
 	router := mux.NewRouter()
 	AddCustomerRoutes(log.NewNopLogger(), router, scope.customerRepo, nil, nil)
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("GET", "/customers"+query, nil)
-	req.Header.Set("X-Organization", "organization")
+	req.Header.Set("X-Organization", organization)
 	router.ServeHTTP(w, req)
 
 	var customers []*client.Customer
@@ -44,7 +44,7 @@ func (scope *Scope) GetCustomers(query string) ([]*client.Customer, error) {
 	return customers, nil
 }
 
-func (scope *Scope) CreateCustomers(count int, customerType client.CustomerType) []client.Customer {
+func (scope *Scope) CreateCustomers(count int, customerType client.CustomerType, organization string) []client.Customer {
 	var customers []client.Customer
 	for i := 0; i < count; i++ {
 		var firstName string
@@ -53,20 +53,20 @@ func (scope *Scope) CreateCustomers(count int, customerType client.CustomerType)
 		scope.fuzzer.Fuzz(&firstName)
 		scope.fuzzer.Fuzz(&lastName)
 		scope.fuzzer.Fuzz(&email)
-		customer := scope.CreateCustomer(firstName, lastName, email, customerType)
+		customer := scope.CreateCustomer(firstName, lastName, organization, email, customerType)
 		customers = append(customers, customer)
 	}
 	return customers
 }
 
-func (scope *Scope) CreateCustomer(firstName, lastName, email string, customerType client.CustomerType) client.Customer {
+func (scope *Scope) CreateCustomer(firstName, lastName, organization, email string, customerType client.CustomerType) client.Customer {
 	cust, _, _ := (customerRequest{
 		FirstName: firstName,
 		LastName:  lastName,
 		Email:     email,
 		Type:      customerType,
 	}).asCustomer(testCustomerSSNStorage(scope.t))
-	if err := scope.customerRepo.CreateCustomer(cust, "organization"); err != nil {
+	if err := scope.customerRepo.CreateCustomer(cust, organization); err != nil {
 		scope.t.Error(err)
 	}
 	return *cust
diff --git a/pkg/customers/customer_search_test.go b/pkg/customers/customer_search_test.go
index 49447af..e09c440 100644
--- a/pkg/customers/customer_search_test.go
+++ b/pkg/customers/customer_search_test.go
@@ -194,7 +194,8 @@ func TestRepository__searchCustomers(t *testing.T) {
 
 func TestCustomerSearchEmpty(t *testing.T) {
 	scope := Setup(t)
-	customers, _ := scope.GetCustomers("")
+	organization := "organization"
+	customers, _ := scope.GetCustomers("", organization)
 	if customers == nil {
 		t.Fatalf("expected allocated array:\n  %T %#v", customers, customers)
 	}
@@ -202,50 +203,55 @@ func TestCustomerSearchEmpty(t *testing.T) {
 
 func TestGet20MostRecentlyCreatedCustomersByDefault(t *testing.T) {
 	scope := Setup(t)
-	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL)
-	customers, _ := scope.GetCustomers("")
+	organization := "organization"
+	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL, organization)
+	customers, _ := scope.GetCustomers("", organization)
 	scope.assert.Equal(20, len(customers))
 }
 
 func TestGet10MostRecentlyCreatedCustomersByDefault(t *testing.T) {
 	scope := Setup(t)
-	scope.CreateCustomers(10, client.CUSTOMERTYPE_INDIVIDUAL)
-	customers, _ := scope.GetCustomers("")
+	organization := "organization"
+	scope.CreateCustomers(10, client.CUSTOMERTYPE_INDIVIDUAL, organization)
+	customers, _ := scope.GetCustomers("", organization)
 	scope.assert.Equal(10, len(customers))
 }
 
 func TestGet50MostRecentlyCreatedCustomersWhenSpecifyingLimit(t *testing.T) {
 	scope := Setup(t)
-	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL)
-	customers, _ := scope.GetCustomers("?count=50")
+	organization := "organization"
+	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL, organization)
+	customers, _ := scope.GetCustomers("?count=50", organization)
 	scope.assert.Equal(50, len(customers))
 }
 
 func TestGet100MostRecentlyCreatedCustomersWhenSpecifyingMoreThanAvailable(t *testing.T) {
 	scope := Setup(t)
-	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL)
-	customers, _ := scope.GetCustomers("?count=120")
+	organization := "organization"
+	scope.CreateCustomers(100, client.CUSTOMERTYPE_INDIVIDUAL, organization)
+	customers, _ := scope.GetCustomers("?count=120", organization)
 	scope.assert.Equal(100, len(customers))
 }
 
 func TestSearchCustomersWithVerifiedStatus(t *testing.T) {
 	// Create two customers. 1 with Unknown STATUS and 1 with Verified
 	scope := Setup(t)
-	customer := scope.CreateCustomer("John", "Doe", "john.doe@email.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	customer := scope.CreateCustomer("John", "Doe", organization, "john.doe@email.com", client.CUSTOMERTYPE_INDIVIDUAL)
 	if err := scope.customerRepo.updateCustomerStatus(customer.CustomerID, client.CUSTOMERSTATUS_VERIFIED, "test comment"); err != nil {
 		print(err)
 	}
-	scope.CreateCustomer("Jane", "Doe", "jane.doe@email.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	scope.CreateCustomer("Jane", "Doe", organization, "jane.doe@email.com", client.CUSTOMERTYPE_INDIVIDUAL)
 
 	// Should have 1 Verified Status
-	verifiedCustomers, _ := scope.GetCustomers("?status=Verified&count=20")
+	verifiedCustomers, _ := scope.GetCustomers("?status=Verified&count=20", organization)
 	scope.assert.Equal(1, len(verifiedCustomers))
 	for i := 0; i < len(verifiedCustomers); i++ {
 		scope.assert.Equal("Verified", string(verifiedCustomers[i].Status))
 	}
 
 	// Should have 1 Unknown Status
-	unknownStatusCustomers, _ := scope.GetCustomers("?status=Unknown&count=20")
+	unknownStatusCustomers, _ := scope.GetCustomers("?status=Unknown&count=20", organization)
 	scope.assert.Equal(1, len(unknownStatusCustomers))
 	for i := 0; i < len(unknownStatusCustomers); i++ {
 		scope.assert.Equal("Unknown", string(unknownStatusCustomers[i].Status))
@@ -258,40 +264,42 @@ func TestSearchCustomersByName(t *testing.T) {
 		logger: log.NewNopLogger(),
 		db:     database.CreateTestMySQLDB(t).DB,
 	}
-	_ = scope.CreateCustomer("Jane", "Doe", "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
-	_ = scope.CreateCustomer("John", "Doe", "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	_ = scope.CreateCustomer("Jane", "Doe", organization, "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	_ = scope.CreateCustomer("John", "Doe", organization, "jane.doe@gmail.com", client.CUSTOMERTYPE_BUSINESS)
 
-	customers, _ := scope.GetCustomers("?query=jane")
+	customers, _ := scope.GetCustomers("?query=jane", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jane+doe")
+	customers, _ = scope.GetCustomers("?query=jane+doe", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=john")
+	customers, _ = scope.GetCustomers("?query=john", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=john+doe")
+	customers, _ = scope.GetCustomers("?query=john+doe", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=doe")
+	customers, _ = scope.GetCustomers("?query=doe", organization)
 	scope.assert.Equal(2, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jim+doe")
+	customers, _ = scope.GetCustomers("?query=jim+doe", organization)
 	scope.assert.Equal(0, len(customers))
 }
 
 func TestSearchCustomersByEmail(t *testing.T) {
 	scope := Setup(t)
-	_ = scope.CreateCustomer("Jane", "Doe", "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
-	_ = scope.CreateCustomer("John", "Doe", "john.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	_ = scope.CreateCustomer("Jane", "Doe", organization, "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	_ = scope.CreateCustomer("John", "Doe", organization, "john.doe@gmail.com", client.CUSTOMERTYPE_BUSINESS)
 
-	customers, _ := scope.GetCustomers("?email=jane.doe@gmail.com")
+	customers, _ := scope.GetCustomers("?email=jane.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?email=john.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?email=john.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?email=jim.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?email=jim.doe@gmail.com", organization)
 	scope.assert.Equal(0, len(customers))
 }
 
@@ -301,74 +309,78 @@ func TestSearchCustomersByNameAndEmail(t *testing.T) {
 		logger: log.NewNopLogger(),
 		db:     database.CreateTestMySQLDB(t).DB,
 	}
-	_ = scope.CreateCustomer("Jane", "Doe", "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
-	_ = scope.CreateCustomer("John", "Doe", "john.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	_ = scope.CreateCustomer("Jane", "Doe", organization, "jane.doe@gmail.com", client.CUSTOMERTYPE_INDIVIDUAL)
+	_ = scope.CreateCustomer("John", "Doe", organization, "john.doe@gmail.com", client.CUSTOMERTYPE_BUSINESS)
 
-	customers, _ := scope.GetCustomers("?query=jane+doe&email=jane.doe@gmail.com")
+	customers, _ := scope.GetCustomers("?query=jane+doe&email=jane.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jane&email=jane.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=jane&email=jane.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=john+doe&email=john.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=john+doe&email=john.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=john&email=john.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=john&email=john.doe@gmail.com", organization)
 	scope.assert.Equal(1, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jane+doe&email=jim.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=jane+doe&email=jim.doe@gmail.com", organization)
 	scope.assert.Equal(0, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jane&email=jim.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=jane&email=jim.doe@gmail.com", organization)
 	scope.assert.Equal(0, len(customers))
 
-	customers, _ = scope.GetCustomers("?query=jim&email=jane.doe@gmail.com")
+	customers, _ = scope.GetCustomers("?query=jim&email=jane.doe@gmail.com", organization)
 	scope.assert.Equal(0, len(customers))
 }
 
 func TestSearchCustomersUsingPaging(t *testing.T) {
 	scope := Setup(t)
-	_ = scope.CreateCustomers(30, client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	_ = scope.CreateCustomers(30, client.CUSTOMERTYPE_INDIVIDUAL, organization)
 
 	// Get first page of 10
-	customers, _ := scope.GetCustomers("?skip=0&count=10")
+	customers, _ := scope.GetCustomers("?skip=0&count=10", organization)
 	scope.assert.Equal(10, len(customers))
 
 	// Get second page of 10
-	customers, _ = scope.GetCustomers("?skip=10&count=10")
+	customers, _ = scope.GetCustomers("?skip=10&count=10", organization)
 	scope.assert.Equal(10, len(customers))
 
 	// Get third page of 10
-	customers, _ = scope.GetCustomers("?skip=20&count=10")
+	customers, _ = scope.GetCustomers("?skip=20&count=10", organization)
 	scope.assert.Equal(10, len(customers))
 
 	// Should be no 4th page of 10
-	customers, _ = scope.GetCustomers("?skip=30&count=10")
+	customers, _ = scope.GetCustomers("?skip=30&count=10", organization)
 	scope.assert.Equal(0, len(customers))
 }
 
 func TestSearchCustomersUsingPagingFailure(t *testing.T) {
 	scope := Setup(t)
-	_ = scope.CreateCustomers(30, client.CUSTOMERTYPE_INDIVIDUAL)
+	organization := "organization"
+	_ = scope.CreateCustomers(30, client.CUSTOMERTYPE_INDIVIDUAL, organization)
 
-	customers, _ := scope.GetCustomers("?skip=123abc")
+	customers, _ := scope.GetCustomers("?skip=123abc", organization)
 	scope.assert.Equal(0, len(customers))
 
-	customers, _ = scope.GetCustomers("?count=123abc")
+	customers, _ = scope.GetCustomers("?count=123abc", organization)
 	scope.assert.Equal(0, len(customers))
 
-	customers, _ = scope.GetCustomers("?skip=123abc&count=123abc")
+	customers, _ = scope.GetCustomers("?skip=123abc&count=123abc", organization)
 	scope.assert.Equal(0, len(customers))
 }
 
 func TestSearchCustomersByType(t *testing.T) {
 	scope := Setup(t)
-	_ = scope.CreateCustomers(10, client.CUSTOMERTYPE_INDIVIDUAL)
-	_ = scope.CreateCustomers(20, client.CUSTOMERTYPE_BUSINESS)
+	organization := "organization"
+	_ = scope.CreateCustomers(10, client.CUSTOMERTYPE_INDIVIDUAL, organization)
+	_ = scope.CreateCustomers(20, client.CUSTOMERTYPE_BUSINESS, organization)
 
-	individualCustomers, _ := scope.GetCustomers("?type=individual")
+	individualCustomers, _ := scope.GetCustomers("?type=individual", organization)
 	scope.assert.Equal(10, len(individualCustomers))
 
-	businessCustomers, _ := scope.GetCustomers("?type=business")
+	businessCustomers, _ := scope.GetCustomers("?type=business", organization)
 	scope.assert.Equal(20, len(businessCustomers))
 }
diff --git a/pkg/customers/customers_test.go b/pkg/customers/customers_test.go
index 1c44a30..552cf51 100644
--- a/pkg/customers/customers_test.go
+++ b/pkg/customers/customers_test.go
@@ -41,7 +41,7 @@ type testCustomerRepository struct {
 	savedSearchResult *client.OfacSearch
 }
 
-func (r *testCustomerRepository) GetCustomer(customerID string) (*client.Customer, error) {
+func (r *testCustomerRepository) GetCustomer(customerID, organization string) (*client.Customer, error) {
 	if r.err != nil {
 		return nil, r.err
 	}
@@ -94,7 +94,7 @@ func (r *testCustomerRepository) deleteCustomerAddress(customerID string, addres
 	return r.err
 }
 
-func (r *testCustomerRepository) getLatestCustomerOFACSearch(customerID string) (*client.OfacSearch, error) {
+func (r *testCustomerRepository) getLatestCustomerOFACSearch(customerID, organization string) (*client.OfacSearch, error) {
 	if r.err != nil {
 		return nil, r.err
 	}
@@ -139,18 +139,19 @@ func TestCustomers__GetCustomer(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	cust, _, _ := (customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
 		Email:     "jane@example.com",
 	}).asCustomer(testCustomerSSNStorage(t))
-	if err := repo.CreateCustomer(cust, "organization"); err != nil {
+	if err := repo.CreateCustomer(cust, organization); err != nil {
 		t.Fatal(err)
 	}
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("GET", fmt.Sprintf("/customers/%s", cust.CustomerID), nil)
-	req.Header.Set("x-organization", "test")
+	req.Header.Set("x-organization", organization)
 	req.Header.Set("x-request-id", "test")
 
 	router := mux.NewRouter()
@@ -193,6 +194,7 @@ func TestCustomers__DeleteCustomer(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	cr := &customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
@@ -200,10 +202,10 @@ func TestCustomers__DeleteCustomer(t *testing.T) {
 	}
 	customer, _, _ := cr.asCustomer(testCustomerSSNStorage(t))
 	require.NoError(t,
-		repo.CreateCustomer(customer, "organization"),
+		repo.CreateCustomer(customer, organization),
 	)
 
-	got, err := repo.GetCustomer(customer.CustomerID)
+	got, err := repo.GetCustomer(customer.CustomerID, organization)
 	require.NoError(t, err)
 	require.NotNil(t, got)
 
@@ -217,23 +219,24 @@ func TestCustomers__DeleteCustomer(t *testing.T) {
 
 	require.Equal(t, http.StatusNoContent, w.Code)
 	require.Empty(t, w.Body)
-	got, err = repo.GetCustomer(customer.CustomerID)
+	got, err = repo.GetCustomer(customer.CustomerID, organization)
 	require.Error(t, err)
 	require.Nil(t, got)
 }
 
 func TestCustomerRepository__CreateCustomer(t *testing.T) {
+	organization := "organization"
 	check := func(t *testing.T, repo *sqlCustomerRepository) {
 		cust, _, _ := (customerRequest{
 			FirstName: "Jane",
 			LastName:  "Doe",
 			Email:     "jane@example.com",
 		}).asCustomer(testCustomerSSNStorage(t))
-		if err := repo.CreateCustomer(cust, "organization"); err != nil {
+		if err := repo.CreateCustomer(cust, organization); err != nil {
 			t.Fatal(err)
 		}
 
-		cust, err := repo.GetCustomer(cust.CustomerID)
+		cust, err := repo.GetCustomer(cust.CustomerID, organization)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -406,6 +409,7 @@ func TestCustomers__updateCustomer(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	createReq := &customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
@@ -432,10 +436,10 @@ func TestCustomers__updateCustomer(t *testing.T) {
 	}
 	customer, _, _ := createReq.asCustomer(testCustomerSSNStorage(t))
 	require.NoError(t,
-		repo.CreateCustomer(customer, "organization"),
+		repo.CreateCustomer(customer, organization),
 	)
 
-	_, err := repo.GetCustomer(customer.CustomerID)
+	_, err := repo.GetCustomer(customer.CustomerID, organization)
 	require.NoError(t, err)
 
 	router := mux.NewRouter()
@@ -529,7 +533,8 @@ func TestCustomers__repository(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
-	cust, err := repo.GetCustomer(base.ID())
+	organization := "organization"
+	cust, err := repo.GetCustomer(base.ID(), organization)
 	if err == nil {
 		t.Errorf("expected not found error: %v", err)
 	}
@@ -558,7 +563,7 @@ func TestCustomers__repository(t *testing.T) {
 			},
 		},
 	}).asCustomer(testCustomerSSNStorage(t))
-	if err := repo.CreateCustomer(cust, "organization"); err != nil {
+	if err := repo.CreateCustomer(cust, organization); err != nil {
 		t.Error(err)
 	}
 	if cust == nil {
@@ -569,7 +574,7 @@ func TestCustomers__repository(t *testing.T) {
 	}
 
 	// read
-	cust, err = repo.GetCustomer(cust.CustomerID)
+	cust, err = repo.GetCustomer(cust.CustomerID, organization)
 	if err != nil {
 		t.Error(err)
 	}
@@ -641,6 +646,7 @@ func TestCustomerRepository__updateCustomer(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	createReq := customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
@@ -662,7 +668,7 @@ func TestCustomerRepository__updateCustomer(t *testing.T) {
 		},
 	}
 	newCust, _, _ := createReq.asCustomer(testCustomerSSNStorage(t))
-	err := repo.CreateCustomer(newCust, "organization")
+	err := repo.CreateCustomer(newCust, organization)
 	require.NoError(t, err)
 
 	updateReq := customerRequest{
@@ -684,7 +690,7 @@ func TestCustomerRepository__updateCustomer(t *testing.T) {
 	}
 
 	updatedCust, _, _ := updateReq.asCustomer(testCustomerSSNStorage(t))
-	err = repo.updateCustomer(updatedCust, "organization")
+	err = repo.updateCustomer(updatedCust, organization)
 	require.NoError(t, err)
 
 	require.Equal(t, newCust.CustomerID, updatedCust.CustomerID)
@@ -700,12 +706,13 @@ func TestCustomerRepository__updateCustomerStatus(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	cust, _, _ := (customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
 		Email:     "jane@example.com",
 	}).asCustomer(testCustomerSSNStorage(t))
-	if err := repo.CreateCustomer(cust, "organization"); err != nil {
+	if err := repo.CreateCustomer(cust, organization); err != nil {
 		t.Fatal(err)
 	}
 
@@ -715,7 +722,7 @@ func TestCustomerRepository__updateCustomerStatus(t *testing.T) {
 	}
 
 	// read the status back
-	customer, err := repo.GetCustomer(cust.CustomerID)
+	customer, err := repo.GetCustomer(cust.CustomerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -728,12 +735,13 @@ func TestCustomersRepository__addCustomerAddress(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	cust, _, _ := (customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
 		Email:     "jane@example.com",
 	}).asCustomer(testCustomerSSNStorage(t))
-	if err := repo.CreateCustomer(cust, "organization"); err != nil {
+	if err := repo.CreateCustomer(cust, organization); err != nil {
 		t.Fatal(err)
 	}
 
@@ -750,7 +758,7 @@ func TestCustomersRepository__addCustomerAddress(t *testing.T) {
 	}
 
 	// re-read
-	cust, err := repo.GetCustomer(cust.CustomerID)
+	cust, err := repo.GetCustomer(cust.CustomerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -766,12 +774,13 @@ func TestCustomers__replaceCustomerMetadata(t *testing.T) {
 	repo := createTestCustomerRepository(t)
 	defer repo.close()
 
+	organization := "organization"
 	cust, _, _ := (customerRequest{
 		FirstName: "Jane",
 		LastName:  "Doe",
 		Email:     "jane@example.com",
 	}).asCustomer(testCustomerSSNStorage(t))
-	if err := repo.CreateCustomer(cust, "organization"); err != nil {
+	if err := repo.CreateCustomer(cust, organization); err != nil {
 		t.Fatal(err)
 	}
 
@@ -779,7 +788,7 @@ func TestCustomers__replaceCustomerMetadata(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("PUT", fmt.Sprintf("/customers/%s/metadata", cust.CustomerID), body)
-	req.Header.Set("x-organization", "test")
+	req.Header.Set("x-organization", organization)
 	req.Header.Set("x-request-id", "test")
 
 	router := mux.NewRouter()
@@ -945,8 +954,19 @@ func TestCustomerRepository__OFAC(t *testing.T) {
 	defer repo.close()
 
 	customerID := base.ID()
+	organization := "organization"
+
+	cust, _, _ := (customerRequest{
+		CustomerID: customerID,
+		FirstName:  "Jane",
+		LastName:   "Doe",
+		Email:      "jane@example.com",
+	}).asCustomer(testCustomerSSNStorage(t))
+	if err := repo.CreateCustomer(cust, organization); err != nil {
+		t.Fatal(err)
+	}
 
-	res, err := repo.getLatestCustomerOFACSearch(customerID)
+	res, err := repo.getLatestCustomerOFACSearch(customerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -958,7 +978,7 @@ func TestCustomerRepository__OFAC(t *testing.T) {
 	if err := repo.saveCustomerOFACSearch(customerID, client.OfacSearch{EntityID: "14141"}); err != nil {
 		t.Fatal(err)
 	}
-	res, err = repo.getLatestCustomerOFACSearch(customerID)
+	res, err = repo.getLatestCustomerOFACSearch(customerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -970,7 +990,7 @@ func TestCustomerRepository__OFAC(t *testing.T) {
 	if err := repo.saveCustomerOFACSearch(customerID, client.OfacSearch{EntityID: "777121"}); err != nil {
 		t.Fatal(err)
 	}
-	res, err = repo.getLatestCustomerOFACSearch(customerID)
+	res, err = repo.getLatestCustomerOFACSearch(customerID, organization)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/reports/router_test.go b/pkg/reports/router_test.go
index e8f5593..19572ca 100644
--- a/pkg/reports/router_test.go
+++ b/pkg/reports/router_test.go
@@ -25,10 +25,12 @@ func TestGetAccounts(t *testing.T) {
 	db := database.CreateTestSqliteDB(t).DB
 	customerRepo := customers.NewCustomerRepo(logger, db)
 	accountRepo := accounts.NewRepo(logger, db)
+	organization := "organization"
 	AddRoutes(log.NewNopLogger(), router, customerRepo, accountRepo)
 
 	// Check request without query parameters
 	req := httptest.NewRequest("GET", "/reports/accounts", nil)
+	req.Header.Set("x-organization", organization)
 	res := httptest.NewRecorder()
 	router.ServeHTTP(res, req)
 	require.Equal(t, http.StatusOK, res.Code)
@@ -45,7 +47,7 @@ func TestGetAccounts(t *testing.T) {
 			CustomerID: base.ID(),
 			FirstName:  fmt.Sprintf("%d", i),
 		}
-		err := customerRepo.CreateCustomer(cust, "test")
+		err := customerRepo.CreateCustomer(cust, organization)
 		require.NoError(t, err)
 
 		account, err := accountRepo.CreateCustomerAccount(
@@ -62,7 +64,7 @@ func TestGetAccounts(t *testing.T) {
 	q.Add("accountIDs", strings.Join(accountIDs, ","))
 	req.URL.RawQuery = q.Encode()
 	req = httptest.NewRequest("GET", req.URL.String(), nil)
-
+	req.Header.Set("x-organization", organization)
 	res = httptest.NewRecorder()
 	router.ServeHTTP(res, req)
 	require.Equal(t, http.StatusOK, res.Code)