Terminology

The project uses a fixed vocabulary across code, docs, and comments. These docs follow the same rules.

Use	Never use
`tenant`	`customer`, `org`, `organization`
`grant`	`permission`, `access_grant`, `proxy_permission`
`key`	`api_key` (in prose; `api_key` is fine as a code field name)
`slug`	`subdomain`, `url_name`
`caller`	`requester`, `invoker`
`client`	`customer`

The only exception is the AWS tag CustomerName, which comes from the copebit account template and must stay as-is.

API naming convention

Backend (Python) is snake_case — request body keys, query params, response fields, DynamoDB attributes.
Frontend (TypeScript) is camelCase — all type properties and variables.

Conversion happens at the HTTP boundary:

Responses (snake → camel): automatic via camelizeKeys().
Request bodies (camel → snake): automatic via snakelizeKeys() — never hardcode snake_case in frontend body fields.
Query parameters: sent camelCase, read camelCase (no conversion).