OptionalincludeDeleted?: booleanDefault: false
Bust every cached page — consumer or admin — that a write touching
customerIds could have affected.
The collection tag is always cleared alongside, because an unscoped admin page carries only that tag and no customer id can reach it.
keys deletes exact entries in addition to the tag surgery, passing the
key arguments — this cache hashes and prefixes them. It exists because
invalidateTag resolves keys through the FT index, which does not exist in
memory mode (valkeyClient: null); there the tag bust is a total no-op, and
an exact-key delete is the only thing that keeps read-after-write honest.
Services that folded get onto search pass that get's arguments.
These deletes only reach this instance's own key space, because the key space is partitioned per surface. That is sufficient, and a writer must not try to name the other surface's key:
get entry is itself tagged (by customer
id, or by the collection tag when unscoped), so the tag bust above already
evicts it from the shared L2 and publishes the peer eviction.OptionalcountriesOfIncorporation?: string[]OptionalcreatedAt?: DbTimestampCriteriaOptionalcustomerIds?: string[]OptionaldescriptionLike?: stringPartial match on description
Optionalids?: string[]OptionalincludeDeleted?: booleanOptionallegalEntityTypeLike?: stringPartial match on legal entity type
OptionallegalEntityTypes?: (Exact match to these canonical legal-entity-type codes (US structures).
OptionalnameLike?: stringPartial match on legal entity name
OptionalorderBy?: DbOrderByCriterion<Optionalpage?: numberDefaults to 1
OptionalpageSize?: numberDefaults to 10
Optionalq?: stringUnified free-text search: matches the organization's legal name, either
frozen beneficiary alias (ach_name / wire_name), its own external id
(org_...), the owning customer's name, or the customer's external id
(cust_...). Whitespace-only values are a no-op.
OptionalreferenceIdLike?: stringPartial match on reference ID
OptionalreferenceIds?: string[]OptionalrouteFusionEntityIds?: string[]Matches the pinned RouteFusion business-entity id on
data->'routeFusionEntity'->>'entityId'. Mirrors the VA-side filter for
reverse-lookup (RF entity webhook → owning org).
Optionalstatuses?: ("ACTIVE" | "DELETED" | "DISABLED" | "PENDING_VERIFICATION")[]Optionalunverified?: booleanOptionalupdatedAt?: DbTimestampCriteriaOptionaluuids?: string[]ProtectedsearchTags to write on a page, derived from the scope the query searched — never from the customers present in the result.
That distinction is load-bearing. An entry tagged with the customer ids in
the page carries no tags when the page is empty, so nothing can ever bust
it and a later create leaves it stale for the full L2 TTL. Tagging by
scope means an empty page still carries the tag for what it searched.
An unscoped read falls back to the collection tag, since no customer-id tag can reach a row whose owner did not exist when the entry was written.
Pin the RouteFusion business entity onto the org — minted once, reused for
every VA. The pin is CONDITIONAL (WHERE data->'routeFusionEntity' IS NULL) so two concurrent onboards can't both mint: the loser's UPDATE
matches no row, and the subsequent re-read returns the winner's pinned
value. A missing org (re-read finds nothing) is NOT_FOUND.
requiredDocuments is the OR-of-AND document-set snapshot from RF's
entityRequiredFields, resolved for the org's real country/business type
at mint time (see onboardRouteFusionEntity). Optional so legacy callers
(and tests) can still pin without it.
Update only the pinned entity's KYB status (RF entity webhook →
VERIFIED/REJECTED), leaving entityId/programId intact. Matches only
when an entity is already pinned; a status-only write on an org with no
pinned entity is NOT_FOUND.
Admin org write. Accepts the full editable business-field set, mapping each
field exactly as OrganizationService.update does (top-level columns
vs data jsonb), but WITHOUT triggering AiPrise verification.
status is CALLER-CONTROLLED — this path does NOT force
PENDING_VERIFICATION. That lets the AiPrise callback set ACTIVE /
persist incorporationDate without a reset, while the admin edit action
passes status: "PENDING_VERIFICATION" explicitly to re-trigger KYB when
business details change.
StaticadminThe exact key OrganizationAdminQueryService.get reads through, for its
includeDeleted: false callers.
The includeDeleted: true variant hashes differently and is reached only by
the collection tag, which every Valkey-backed environment has. That gap is
deliberate and pre-existing: it only matters in memory mode, where no admin
get runs with includeDeleted: true.
StaticconsumerThe exact key OrganizationQueryService.get reads through.
get folds onto search, so these args must stay identical to the ones it
passes ({ customerId, ids: [id], pageSize: 1 }) plus the defaults search
bakes into its own key — includeDeleted: false and page: 1. Every other
filter is undefined there, and serviceCacheKey canonicalizes with JCS,
which drops undefined properties. organizationCache.test.ts pins the
equivalence.
StaticdeserializeThe inverse of serializeOrganization: rehydrates the Date fields.
StaticserializeA search row → its JSON-safe form. Safe to call without a cache instance.
Cross-customer admin access to organizations.
Extends OrganizationCache, so this read shares the
organization-searchnamespace — and therefore the customer-id tag vocabulary — with the consumer surface. A consumer write for a customer evicts the admin pages scoped to that customer, and vice versa, without either service referencing the other.