You're right to expect that behavior! The Java SDK configuration shows that there's a

defaultTenant

setting that defaults to

"default"

and a

useDefaultTenantIfEmpty

flag that defaults to

true

(1) .

// multi tenancy config
private String defaultTenant = "default";
private Boolean useDefaultTenantIfEmpty = true;

The PermitConfig documentation explains that

getDefaultTenant()

returns "the key of the default tenant used for permission checks if a tenant is not specified (or known) for the resource provided to permit.check() " and

shouldUseDefaultTenantIfEmpty()

returns "whether the default tenant should be used if the resource tenant is not specified" . This means when you don't specify a tenant in your API calls, it should automatically use the "default" tenant. If you're seeing users being created without tenant assignments when you omit the tenant parameter, this might be unexpected behavior. To ensure users are always assigned to the default tenant, you have a couple of options: 1. Explicitly include the tenant in your API calls - for example, when creating or syncing users, include

"tenant": "default"

(2) 2. Include role assignments during user creation with the tenant specified :

role_assignments: [{ role: "manager", tenant: "default" }];

If you're experiencing different behavior where omitting the tenant doesn't default to "default", this could be a configuration issue or potentially a bug in your implementation.

To learn more, see the sources I considered: [[1] permitio/permit-java/src/main/java/io/permit/sdk/PermitConfig.java](https://github.com/permitio/permit-java/blob/master/src/main/java/io/permit/sdk/PermitConfig.java) [[2] Sync your First User](https://docs.permit.io/overview/sync-your-first-user-with-sdk)

Looking at the Node.js SDK, there is indeed a configuration for default tenant behavior. In the enforcer code, the

normalizeResource

method shows how the SDK handles empty tenants (1) :

private normalizeResource(resource: IResource) : IResource {
  const normalizedResource: IResource = Object.assign({}, resource) ;

  // if tenant is empty, we might auto-set the default tenant according to config
  if (!normalizedResource.tenant && this.config.multiTenancy.useDefaultTenantIfEmpty) {
    normalizedResource.tenant = this.config.multiTenancy.defaultTenant;
  }

  return normalizedResource;
}

This shows that the Node.js SDK does have

multiTenancy.useDefaultTenantIfEmpty

and

multiTenancy.defaultTenant

configuration options that should automatically apply the default tenant when none is specified . However, this normalization appears to only apply to the

check()

enforcement methods in the enforcer . The API client methods for user creation and role assignments (in the

/api

directory) don't show the same automatic default tenant application (2) . This means: • For permission checks (

permit.check()

) , omitting the tenant should default to "default" if configured • For API operations like user creation or role assignments, you may need to explicitly specify the tenant If you're experiencing inconsistent behavior where some API endpoints don't respect the default tenant setting, you should explicitly include

tenant: "default"

in your API calls to ensure consistent behavior across all operations. To help our engineers investigate this potential inconsistency: 1. Which Workspace / Project / Env are you using? 2. What specific API calls are you making (please share the SDK code) ? 3. Which PDP version are you running? 4. Could you share relevant logs from your PDP showing the behavior?

To learn more, see the sources I considered: [[1] permitio/permit-node/src/enforcement/enforcer.ts](https://github.com/permitio/permit-node/blob/main/src/enforcement/enforcer.ts) [[2] https://github.com/permitio/permit-node/blob/main/src/api](https://github.com/permitio/permit-node/blob/main/src/api)

yea I just think types and documentation is out of sync, not really blocking. Just bit confusing looking at the definitions 😅

Just wanted to put it on y'alls radar

But could I ask. I'm assuming this is expected? always needing to pass in

tenant

?

I think this is a minor issue; which was just ignored up until now both by our team and other customers