The business (your tenant)

Every VUZ resource — a document, a client, a webhook — belongs to exactly one business (a VUZ tenant: an עוסק פטור, עוסק מורשה, or חברה בע"מ). The VUZ dashboard scopes every request with an X-Business-Id header because a logged-in user can own or belong to several businesses.

A public-API credential (API key or OAuth token) is different: it is minted for one specific business and can never touch another, even if the user who created it also owns a second business. Concretely:

• An API key stores its own businessId at creation time.
• An OAuth token is issued after the merchant picks exactly one business on the "select business" step of the Connect flow.
• On every request, VUZ resolves your credential to its business and forces it onto the request — silently ignoring (never trusting) any X-Business-Id you might send.

That's why the Quickstart never sends X-Business-Id — the API key already knows.

Read your business profile

GET /api/v1/businesses/current

Requires business:read. Returns your tenant's profile — legal name, business type (osek_patur / osek_murshe / limited_company), VAT registration number, and current vatRate. Read vatRate here before computing VAT on a document — see VAT & Israeli compliance.