@twin.org/node 0.0.3-next.51 → 0.0.3-next.53

package/dist/locales/en.json

@@ -2,6 +2,8 @@
 	"error": {
 		"node": {
 			"nodeIdentityNotSet": "The node identity is enabled in config but is not set, please set it using the \"node-set-identity\" CLI command.",
+			"nodeOrganizationIdNotSet": "The node organization is not set, please set it using the \"set-node-org-id\".",
+			"tenantsWithoutOrganizationId": "The following tenants have no organization ID assigned. Use the \"set-tenant-org-id\" command to assign one before starting the node: {tenantIds}",
 			"storageFileRootNotSet": "{storageFileRoot} is not set, the server will not start without it, please set it in the shell or create a .env file",
 			"extensionLoadingError": "Failed to load extension \"{extension}\"",
 			"insecureProtocol": "Cannot load extension from insecure protocol: {protocol}. Only HTTPS is allowed for remote extensions.",
@@ -15,10 +17,12 @@
 			"invalidPublicOrigin": "The public origin \"{publicOrigin}\" is not a valid origin URL, it should be in the format \"protocol://host[:port]\"."
 		},
 		"bootstrapLegacy": {
-			"noFeaturesEnabled": "No features are enabled in legacy bootstrap mode, at least one feature must be enabled."
+			"noFeaturesEnabled": "No features are enabled in legacy bootstrap mode, at least one feature must be enabled.",
+			"organizationNotSet": "The organisation identity has not been set. Run bootstrap with the \"node-identity\" feature first."
 		},
 		"identityCreate": {
-			"invalidMnemonic": "The mnemonic is invalid, it should be 24 words from the standard wordlist."
+			"invalidMnemonic": "The mnemonic is invalid, it should be 24 words from the standard wordlist.",
+			"nodeOrganizationIdNotAvailableInMultiTenantMode": "The node-organization-id option is not available in multi-tenant mode, use tenant-organization-id instead."
 		},
 		"identityImport": {
 			"identityNotFound": "The identity was not found, it must be created on-chain already.",
@@ -33,11 +37,6 @@
 		"tenantCreate": {
 			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
 		},
-		"tenantToken": {
-			"tenantIdOrApiKeyRequired": "Either a tenant ID or an API key must be provided.",
-			"urlTransformerComponentNotRegistered": "The URL transformer component is not registered, ensure the node is configured correctly.",
-			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
-		},
 		"tenantImport": {
 			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command."
 		},
@@ -58,6 +57,17 @@
 		"nodeSetIdentity": {
 			"identityNotFound": "The identity with DID \"{notFoundId}\" was not found in the system."
 		},
+		"setNodeOrgId": {
+			"notAvailableInMultiTenantMode": "The set-node-org-id command is not available in multi-tenant mode, use set-tenant-org-id instead."
+		},
+		"applyOrganizationIdToTenant": {
+			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command.",
+			"organizationIdAlreadyInUse": "The organization ID \"{organizationId}\" is already assigned to tenant \"{conflictingTenantId}\"."
+		},
+		"removeTenantOrgAlias": {
+			"tenantAdminComponentNotRegistered": "Multi-tenant support must be enabled to use this command.",
+			"aliasNotFound": "The alias \"{alias}\" was not found in the tenant organization legacy list."
+		},
 		"entityStorageAuthenticationService": {
 			"loginFailed": "Login failed",
 			"userNotFound": "The user with the specified e-mail could not be found",
@@ -330,9 +340,12 @@
 		},
 		"tenantProcessor": {
 			"missingApiKey": "API key \"{keyName}\" is missing",
-			"missingTenantToken": "Tenant token query parameter \"{paramName}\" is missing",
-			"apiKeyNotFound": "No node tenant found for API key \"{key}\".",
-			"tenantNotFound": "No node tenant found for the decrypted tenant token \"{tenantId}\"."
+			"missingOrganizationId": "Organization ID query parameter \"{paramName}\" is missing",
+			"apiKeyNotFound": "No tenant found for API key \"{key}\".",
+			"organizationIdNotFound": "No tenant found for organization ID \"{organizationId}\"."
+		},
+		"singleTenantProcessor": {
+			"invalidOrganizationId": "Organization ID query parameter \"{paramName}\" value \"{value}\" is not valid for this node"
 		},
 		"tenantAdminService": {
 			"apiKeyAlreadyInUse": "The provided API key is already in use by another tenant.",
@@ -384,12 +397,6 @@
 			"entityStorageMissing": "Entity storage configuration missing for component \"{storageName}\"",
 			"connectorUnknownType": "Unknown connector type \"{type}\" specified for \"{connectorType}\""
 		},
-		"urlTransformerService": {
-			"encryptionUnavailable": "Encryption is unavailable because no nodeId is configured",
-			"decryptionUnavailable": "Decryption is unavailable because no nodeId is configured",
-			"encryptionFailed": "An error occurred during encryption",
-			"decryptionFailed": "An error occurred during decryption"
-		},
 		"healthService": {
 			"componentHealthCheckFailed": "Health check failed for component \"{className}\""
 		},
@@ -578,6 +585,9 @@
 			"mimeTypeNotFound": "Unable to detect MIME type from data",
 			"converterNotFound": "Unable to find a converter for the MIME type \"{notFoundId}\""
 		},
+		"dataspaceControlPlaneRestClient": {
+			"notSupportedOnClient": "The method \"{methodName}\" is not supported on the REST client, it can only be used on a server side component"
+		},
 		"dataspaceControlPlaneService": {
 			"transferProcessNotFound": "Transfer Process not found",
 			"pullTransfersNotSupported": "PULL transfers are not supported. Configure dataPlanePath in service configuration to enable PULL transfers.",
@@ -599,11 +609,8 @@
 			"datasetNotInCatalog": "Dataset \"{datasetId}\" not found in Federated Catalogue (Agreement: {agreementId})",
 			"catalogLookupFailed": "Failed to lookup dataset in Federated Catalogue: {datasetId} (Agreement: {agreementId})",
 			"agreementNotMatchingOffer": "Agreement \"{agreementId}\" does not match any Catalog Offer for dataset {datasetId}. Available Offers: {availableOffers}",
-			"organizationContextMissing": "Organization context is missing. Cannot verify Agreement authorization for consumerPid: {consumerPid}",
-			"organizationContextMissingProvider": "Organization context is missing. Cannot verify Agreement authorization for providerPid: {providerPid}",
-			"agreementAssignerMismatch": "Agreement assigner does not match current caller identity. Agreement: {agreementId}, consumerPid: {consumerPid}, expected: {expectedComposite}, actual: {actualAssigner}",
-			"agreementAssignerMismatchProvider": "Agreement assigner does not match current caller identity. Agreement: {agreementId}, providerPid: {providerPid}, expected: {expectedComposite}, actual: {actualAssigner}",
-			"invalidCompositeIdentifier": "Composite tenant identifier is not in a recognised shape (expected `nodeDid` or `nodeDid:tenantIdHash`, where `nodeDid` starts with `did:`). Got: \"{composite}\"",
+			"agreementAssignerMismatch": "Agreement assigner does not match current caller identity. Agreement: {agreementId}, consumerPid: {consumerPid}, expected: {organizationIdentity}, actual: {actualAssigner}",
+			"agreementAssignerMismatchProvider": "Agreement assigner does not match current caller identity. Agreement: {agreementId}, providerPid: {providerPid}, expected: {organizationIdentity}, actual: {actualAssigner}",
 			"agreementAssigneeMismatch": "Agreement assignee does not match expected consumer identity. Agreement: {agreementId}, providerPid: {providerPid}, expected: {expectedConsumerIdentity}, actual: {actualAssignee}",
 			"negotiationInitiationFailed": "Failed to initiate contract negotiation",
 			"datasetNotFoundInCatalog": "Dataset/Offer \"{offerId}\" not found in Federated Catalogue. Cannot initiate negotiation for non-existent offer.",
@@ -628,21 +635,20 @@
 			"dataPlaneNotRegistered": "Push-mode transfer requires the data plane component to be registered (factory key: \"dataspace-data-plane\"). This deployment was configured without a data plane — register one to enable push, or use pull-mode transfers only.",
 			"datasetPublishFailed": "Failed to publish dataset \"{datasetId}\" for app \"{appId}\" (tenant: \"{tenantId}\")",
 			"datasetRemoveFailed": "Failed to remove dataset \"{datasetId}\" from the Federated Catalogue (tenant: \"{tenantId}\")",
-			"datasetNodeContextRequired": "A node context is required to register a dataset.",
 			"datasetAlreadyExists": "A dataset with id \"{existingId}\" already exists.",
 			"datasetNotFound": "Dataset not found",
-			"datasetWrongTenant": "The calling tenant does not own this dataset.",
-			"transferWrongTenant": "The calling tenant does not own this transfer.",
+			"datasetWrongOrganization": "The calling organization does not own this dataset.",
+			"transferWrongOrganization": "The calling organization does not own this transfer.",
 			"invalidDatasetId": "Dataset ID \"{id}\" is not a valid URN or URL"
 		},
 		"dataspaceControlPlanePolicyRequester": {},
+		"trustHelper": {
+			"trustVerifyFailed": "Trust verification failed for action \"{action}\""
+		},
 		"odrlPolicyHelper": {
 			"policyMissingAssignee": "The {policyType} with id \"{policyId}\" is missing an assignee.",
 			"policyMissingAssigner": "The {policyType} with id \"{policyId}\" is missing an assigner."
 		},
-		"trustHelper": {
-			"trustVerifyFailed": "Trust verification failed for action \"{action}\""
-		},
 		"dataspaceDataPlaneRestClient": {
 			"notSupportedOnClient": "The method \"{methodName}\" is not supported on the REST client, it can only be used on a server side component"
 		},
@@ -660,7 +666,7 @@
 			"transferNotInStartedState": "Transfer Process is not in STARTED state. Current state: \"{currentState}\"",
 			"transferMissingDatasetId": "Transfer Process is missing datasetId",
 			"transferMissingDataAddress": "Transfer Process is missing a valid push dataAddress endpoint (consumerPid: {consumerPid})",
-			"pushSubscriptionMissingTenantToken": "Push subscription setup rejected: consumer endpoint does not carry an `x-enc-tenant-token` query parameter (consumerPid: {consumerPid}, endpoint: {endpoint}). On multi-tenant publishers the consumer must bake its tenant token before sending the dataAddress.",
+			"pushSubscriptionMissingOrganizationId": "Push subscription setup rejected: consumer endpoint does not carry an `organization` query parameter (consumerPid: {consumerPid}, endpoint: {endpoint}). On multi-tenant publishers the consumer must bake its organization ID before sending the dataAddress.",
 			"pushSubscriptionStorageNotRegistered": "Push-mode transfer requires push-subscription storage to be registered (entity-storage key: \"push-subscription\"). This deployment was configured without it — register the storage to enable push, or use pull-mode transfers only.",
 			"schemaNotFound": "Schema \"{schemaId}\" not found",
 			"cleanupFailed": "Error occurred during cleanup of activity logs",
@@ -1340,6 +1346,7 @@
 		"extensionHttpsDownloading": "Downloading HTTPS extension",
 		"extensionCacheExpired": "Cache expired for extension: {url}",
 		"extensionForceRefresh": "Force refresh enabled for extension: {url}",
+		"tenantOrganizationIdAutoAssigned": "Legacy migration: automatically assigned organization ID \"{organizationId}\" to tenant \"{tenantId}\".",
 		"cli": {
 			"commands": {
 				"command": "Command",
@@ -1368,16 +1375,18 @@
 					"labels": {
 						"nodeIdentityCreate": "Creating node identity",
 						"nodeAuthKeyCreate": "Creating node auth key",
-						"trustVerificationMethodCreate": "Creating trust verification method for node identity",
+						"trustVerificationMethodCreate": "Creating trust verification method for organisation identity",
 						"nodeIdentitySet": "Setting node identity",
 						"nodeTenantCreate": "Creating node tenant",
 						"organisationCreate": "Creating organisation identity",
 						"blobStorageKeyCreate": "Creating blob storage encryption key for organisation identity",
 						"attestationMethodCreate": "Creating attestation method for organisation identity",
 						"immutableProofMethodCreate": "Creating immutable proof method for organisation identity",
+						"nodeOrganizationIdSet": "Setting node organisation ID",
+						"tenantOrganizationIdSet": "Setting tenant organisation ID",
 						"adminIdentityCreate": "Creating admin user identity",
 						"adminUserCreate": "Creating admin user",
-						"urlTransformParamKeyAdd": "Adding URL transform parameter encryption key"
+						"tenantFallback": "No Node-labelled tenant found; using first available tenant"
 					}
 				},
 				"identity-create": {
@@ -1410,6 +1419,12 @@
 						},
 						"output-env-prefix": {
 							"description": "Prefix to use for variables in the output .env file."
+						},
+						"node-organization-id": {
+							"description": "If true, set the created identity DID as the node organization ID (not available in multi-tenant mode)."
+						},
+						"tenant-organization-id": {
+							"description": "The tenant ID to set the created identity DID as the organization ID for (requires multi-tenant mode)."
 						}
 					},
 					"labels": {
@@ -1604,7 +1619,7 @@
 				},
 				"tenant-create": {
 					"description": "Create a tenant with associated api key",
-					"example": "tenant-create --tenant-id=\"0011..aabb\" --api-key=\"aabb..0099\" --label=\"My Tenant\" --public-origin=\"https://example.com:1234\"",
+					"example": "tenant-create --tenant-id=\"0011..aabb\" --api-key=\"aabb..0099\" --organization-id=\"did:iota:...\" --label=\"My Tenant\" --public-origin=\"https://example.com:1234\"",
 					"params": {
 						"env-prefix": {
 							"description": "Prefix to use for standard .env files e.g. TWIN_."
@@ -1615,6 +1630,9 @@
 						"api-key": {
 							"description": "The API key to associate with the tenant id. If not provided, a random key will be generated."
 						},
+						"organization-id": {
+							"description": "The organization DID to associate with the tenant."
+						},
 						"label": {
 							"description": "A descriptive label for the tenant."
 						},
@@ -1638,6 +1656,7 @@
 						"creating": "Creating tenant",
 						"tenantId": "Tenant ID",
 						"apiKey": "API Key",
+						"organizationId": "Organization ID",
 						"label": "Label",
 						"publicOrigin": "Public Origin"
 					}
@@ -1698,30 +1717,6 @@
 						"updated": "Updated tenant"
 					}
 				},
-				"tenant-token": {
-					"description": "Generate the x-enc-tenant-token token value for a tenant",
-					"example": "tenant-token --tenant-id=\"0011..aabb\"",
-					"params": {
-						"tenant-id": {
-							"description": "The tenant ID to generate the token for."
-						},
-						"api-key": {
-							"description": "The API key to look up the tenant ID from."
-						},
-						"load-env": {
-							"description": "Comma separated list of paths to .env files to read input parameters from."
-						},
-						"output-json": {
-							"description": "Path to a .json file to store the command output."
-						}
-					},
-					"labels": {
-						"lookingUp": "Looking up tenant",
-						"generating": "Generating tenant token",
-						"tenantId": "Tenant ID",
-						"token": "Token"
-					}
-				},
 				"user-create": {
 					"description": "Create a user",
 					"example": "user-create --user-identity=\"did:iota:....\" --organization-identity=\"did:iota:....\" --email=\"bob@examples.com\" --password=\"pass1234\" --scope=\"tenant-admin\" --givenName=\"Bob\" --familyName=\"Smith\"",
@@ -1864,6 +1859,69 @@
 						"publicKeyHex": "Public Key Hex"
 					}
 				},
+				"set-node-org-id": {
+					"description": "Set the node organization ID",
+					"example": "set-node-org-id --organization-id=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"organization-id": {
+							"description": "The organization DID to set as the node organization ID."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"stored": "The node organization ID has been stored"
+					}
+				},
+				"set-tenant-org-id": {
+					"description": "Set the organization ID for a tenant",
+					"example": "set-tenant-org-id --tenant-id=\"0011..aabb\" --organization-id=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"tenant-id": {
+							"description": "The tenant ID to update."
+						},
+						"organization-id": {
+							"description": "The organization DID to set as the tenant organization ID."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"updating": "Updating tenant organization ID",
+						"stored": "The tenant organization ID has been stored"
+					}
+				},
+				"remove-tenant-org-alias": {
+					"description": "Remove an alias from the tenant organization ID legacy list",
+					"example": "remove-tenant-org-alias --tenant-id=\"0011..aabb\" --alias=\"did:iota:...\"",
+					"params": {
+						"env-prefix": {
+							"description": "Prefix to use for standard .env files e.g. TWIN_."
+						},
+						"tenant-id": {
+							"description": "The tenant ID to update."
+						},
+						"alias": {
+							"description": "The organization DID alias to remove from the legacy list."
+						},
+						"load-env": {
+							"description": "Comma separated list of paths to .env files to read input parameters from."
+						}
+					},
+					"labels": {
+						"reading": "Reading tenant",
+						"updating": "Removing alias from tenant organization legacy list",
+						"removed": "The alias has been removed from the tenant organization legacy list"
+					}
+				},
 				"vault-key-import": {
 					"description": "Import a vault key for an identity",
 					"example": "vault-key-import --identity=\"did:iota:....\" --key-id=\"my-key\" --key-type=Ed25519 --private-key-hex=\"15...a2\"",

package/docs/changelog.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.0.3-next.53](https://github.com/iotaledger/twin-node/compare/node-v0.0.3-next.52...node-v0.0.3-next.53) (2026-06-11)
+
+
+### Features
+
+* organization identifiers ([#203](https://github.com/iotaledger/twin-node/issues/203)) ([1a6b176](https://github.com/iotaledger/twin-node/commit/1a6b1760d9f8e43a769407668426c70e1c8e1aa8))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @twin.org/node-core bumped from 0.0.3-next.52 to 0.0.3-next.53
+
+## [0.0.3-next.52](https://github.com/iotaledger/twin-node/compare/node-v0.0.3-next.51...node-v0.0.3-next.52) (2026-06-09)
+
+
+### Miscellaneous Chores
+
+* **node:** Synchronize repo versions
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @twin.org/node-core bumped from 0.0.3-next.51 to 0.0.3-next.52
+
 ## [0.0.3-next.51](https://github.com/iotaledger/twin-node/compare/node-v0.0.3-next.50...node-v0.0.3-next.51) (2026-06-09)
 
 

package/docs/open-api/spec.json

@@ -13158,6 +13158,95 @@
 				}
 			}
 		},
+		"/aig/{id}/proof": {
+			"delete": {
+				"operationId": "auditableItemGraphRemoveProof",
+				"summary": "Remove the notarization proof from all changesets of a graph vertex",
+				"tags": [
+					"Auditable Item Graph"
+				],
+				"parameters": [
+					{
+						"name": "id",
+						"description": "The id of the vertex whose proof should be removed.",
+						"in": "path",
+						"required": true,
+						"schema": {
+							"type": "string"
+						},
+						"style": "simple",
+						"example": "0101010101010101010101010101010101010101010101010101010101010101"
+					}
+				],
+				"security": [
+					{
+						"jwtBearerAuthScheme": []
+					}
+				],
+				"responses": {
+					"204": {
+						"description": "The rest request ended in success with no data."
+					},
+					"400": {
+						"description": "The server cannot process the request, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "GeneralError",
+											"message": "errorMessage",
+											"properties": {
+												"foo": "bar"
+											}
+										}
+									}
+								}
+							}
+						}
+					},
+					"401": {
+						"description": "You are not authorized to use the API or no credentials were supplied, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "UnauthorizedError",
+											"message": "errorMessage"
+										}
+									}
+								}
+							}
+						}
+					},
+					"500": {
+						"description": "The server has encountered a situation it does not know how to handle, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "InternalServerError",
+											"message": "errorMessage"
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
 		"/ais": {
 			"post": {
 				"operationId": "auditableItemStreamCreate",
@@ -15786,6 +15875,116 @@
 				}
 			}
 		},
+		"/ais/{id}/proof": {
+			"delete": {
+				"operationId": "auditableItemStreamRemoveProof",
+				"summary": "Remove the proof from a stream",
+				"tags": [
+					"Auditable Item Stream"
+				],
+				"parameters": [
+					{
+						"name": "id",
+						"description": "The id of the stream to remove the proof from.",
+						"in": "path",
+						"required": true,
+						"schema": {
+							"type": "string"
+						},
+						"style": "simple",
+						"example": "ais:1234567890"
+					}
+				],
+				"security": [
+					{
+						"jwtBearerAuthScheme": []
+					}
+				],
+				"responses": {
+					"204": {
+						"description": "The rest request ended in success with no data."
+					},
+					"400": {
+						"description": "The server cannot process the request, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "GeneralError",
+											"message": "errorMessage",
+											"properties": {
+												"foo": "bar"
+											}
+										}
+									}
+								}
+							}
+						}
+					},
+					"401": {
+						"description": "You are not authorized to use the API or no credentials were supplied, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "UnauthorizedError",
+											"message": "errorMessage"
+										}
+									}
+								}
+							}
+						}
+					},
+					"404": {
+						"description": "The resource you tried to access does not exist, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/NotFoundResponse"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "NotFoundError",
+											"message": "errorMessage",
+											"properties": {
+												"notFoundId": "1"
+											}
+										}
+									}
+								}
+							}
+						}
+					},
+					"500": {
+						"description": "The server has encountered a situation it does not know how to handle, see the content for more details.",
+						"content": {
+							"application/json": {
+								"schema": {
+									"$ref": "#/components/schemas/Error"
+								},
+								"examples": {
+									"exampleResponse": {
+										"value": {
+											"name": "InternalServerError",
+											"message": "errorMessage"
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
 		"/catalog/request": {
 			"post": {
 				"operationId": "catalogRequest",
@@ -19844,7 +20043,6 @@
 											"correlationId": "cid",
 											"dateCreated": "2025-09-03T00:00:00.000Z",
 											"state": "REQUESTED",
-											"nodeIdentity": "did:iota:nodexyz",
 											"organizationIdentity": "did:iota:123456789abcdefghi"
 										}
 									}
@@ -19950,7 +20148,6 @@
 										"correlationId": "cid",
 										"dateCreated": "2025-09-03T00:00:00.000Z",
 										"state": "REQUESTED",
-										"nodeIdentity": "did:iota:nodexyz",
 										"organizationIdentity": "did:iota:123456789abcdefghi"
 									}
 								}
@@ -20159,7 +20356,6 @@
 												"correlationId": "cid",
 												"dateCreated": "2025-09-03T00:00:00.000Z",
 												"state": "REQUESTED",
-												"nodeIdentity": "did:iota:nodexyz",
 												"organizationIdentity": "did:iota:123456789abcdefghi"
 											}
 										]
@@ -22668,17 +22864,9 @@
 						"type": "string",
 						"description": "The public origin of the server that initiated or received this negotiation.\nUsed to construct callback URLs in subsequent async messages."
 					},
-					"tenantId": {
-						"type": "string",
-						"description": "The tenant id this negotiation belongs to."
-					},
-					"nodeIdentity": {
-						"type": "string",
-						"description": "The node identity (DID) used to sign trust payloads."
-					},
 					"organizationIdentity": {
 						"type": "string",
-						"description": "Organization identity (the org DID of the user who initiated or received\nthe negotiation, when a user context was available)."
+						"description": "Organization identity."
 					},
 					"offer": {
 						"$ref": "https://schema.twindev.org/dataspace-protocol/DataspaceProtocolOffer"
@@ -22746,7 +22934,7 @@
 					"correlationId",
 					"dateCreated",
 					"state",
-					"nodeIdentity"
+					"organizationIdentity"
 				]
 			},
 			"RefreshTokenRequest": {
@@ -23340,15 +23528,7 @@
 				"properties": {
 					"identity": {
 						"type": "string",
-						"description": "The identity associated with the payload."
-					},
-					"tenantId": {
-						"type": "string",
-						"description": "The tenant that issued the payload, if multi-tenancy was active at generation time."
-					},
-					"organizationId": {
-						"type": "string",
-						"description": "The organisation that issued the payload, if an authenticated user context was available at generation time."
+						"description": "The organization identity associated with the payload."
 					},
 					"data": {
 						"type": "object",

package/docs/usage.md

@@ -32,9 +32,11 @@ identity-verification-method-create: Create an identity verification method
 identity-verification-method-import: Import an identity verification method
 identity-verifiable-credential-create: Create a verifiable credential
 node-set-identity: Set the node identity
+remove-tenant-org-alias: Remove an alias from the tenant organization ID legacy list
+set-node-org-id: Set the node organization ID
+set-tenant-org-id: Set the organization ID for a tenant
 tenant-create: Create a tenant with associated api key
 tenant-import: Import a tenant with associated api key
-tenant-token: Generate the x-enc-tenant-token token value for a tenant
 tenant-update: Update a tenant with associated api key
 user-create: Create a user
 user-update: Update a user
@@ -115,22 +117,22 @@ twin-node vault-key-create --load-env="node-identity.env" --identity=!NODE_DID -
 twin-node vault-key-import --load-env="node-identity.env,node-auth-key.json" --identity=!NODE_DID --key-id=!TWIN_AUTH_SIGNING_KEY_ID --key-type=!KEY_TYPE --private-key-hex=!PRIVATE_KEY_HEX
 ```
 
-### Add a key associated with the node identity for use in hosting param encryption
+### Import an existing key associated with the node identity for use in authentication signing
 
 ```shell
-twin-node vault-key-create --load-env="node-identity.env" --identity=!NODE_DID --key-id=!TWIN_URL_TRANSFORMER_ENCRYPTION_KEY_ID --key-type=ChaCha20Poly1305 --output-json="node-hosting-param-key.json" --output-env="node-hosting-param.env"
+twin-node vault-key-import --load-env="node-identity.env,my-key.json" --identity=!NODE_DID --key-id=!TWIN_AUTH_SIGNING_KEY_ID --key-type=!KEY_TYPE --private-key-hex=!PRIVATE_KEY_HEX
 ```
 
-### Import an existing key associated with the node identity for use in authentication signing
+### Create an organisation identity
 
 ```shell
-twin-node vault-key-import --load-env="node-identity.env,my-key.json" --identity=!NODE_DID --key-id=!TWIN_AUTH_SIGNING_KEY_ID --key-type=!KEY_TYPE --private-key-hex=!PRIVATE_KEY_HEX
+twin-node identity-create --load-env="node-identity.env" --fund-wallet=true --output-json="organization-identity.json" --output-env="organization-identity.env" --output-env-prefix=organization
 ```
 
 ### Create a tenant to be used by the node
 
 ```shell
-twin-node tenant-create --label="node" --public-origin="https://api.example.com" --output-env-prefix=node --output-json="node-tenant.json" --output-env="node-tenant.env"
+twin-node tenant-create --load-env="organization-identity.env" --label="node" --public-origin="https://api.example.com" --organization-id=!ORGANIZATION_DID --output-env-prefix=node --output-json="node-tenant.json" --output-env="node-tenant.env"
 ```
 
 ### Import a tenant to be used by the node
@@ -145,10 +147,22 @@ twin-node tenant-import --load-env="node-tenant.json" --tenant-id=!NODE_TENANT_I
 twin-node tenant-update --load-env="node-tenant.json" --tenant-id=!NODE_TENANT_ID --label="New Label"
 ```
 
-### Create an organisation identity
+### Set the organization ID on the node
 
 ```shell
-twin-node identity-create --load-env="node-identity.env" --fund-wallet=true --output-json="organization-identity.json" --output-env="organization-identity.env" --output-env-prefix=organization
+twin-node set-node-org-id --load-env="organization-identity.env" --organization-id=!ORGANIZATION_DID
+```
+
+### Set the organization ID on a tenant
+
+```shell
+twin-node set-tenant-org-id --load-env="node-tenant.env,organization-identity.env" --tenant-id=!NODE_TENANT_ID --organization-id=!ORGANIZATION_DID
+```
+
+### Remove an alias from the tenant organization ID legacy list
+
+```shell
+twin-node remove-tenant-org-alias --load-env="node-tenant.env" --tenant-id=!NODE_TENANT_ID --alias=!OLD_ORGANIZATION_DID
 ```
 
 ### Add a verification method to the organisation identity for attestation

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@twin.org/node",
-	"version": "0.0.3-next.51",
+	"version": "0.0.3-next.53",
 	"description": "TWIN Node serving APIs using the specified configuration",
 	"repository": {
 		"type": "git",
@@ -14,7 +14,7 @@
 		"node": ">=20.0.0"
 	},
 	"dependencies": {
-		"@twin.org/node-core": "0.0.3-next.51"
+		"@twin.org/node-core": "0.0.3-next.53"
 	},
 	"bugs": {
 		"url": "git+https://github.com/iotaledger/twin-node/issues"