Resolve the effective branding for your tenant

{
  "data": {
    "logo_url": "https://cdn.example.com/acme/logo.png",
    "logomark_url": "https://cdn.example.com/acme/logomark.svg",
    "primary_color": "#5B2AC3",
    "accent_color": "#F59E0B",
    "dashboard_name": "Acme Support",
    "support_email": "support@acme.example.com",
    "custom_domain": "support.acme.example.com",
    "favicon_url": "https://cdn.example.com/acme/favicon.ico",
    "terms_url": "https://acme.example.com/terms",
    "privacy_url": "https://acme.example.com/privacy",
    "organization_id": "org_01HZQX4E7JQ4M2E2H2DM9XE5",
    "inherited_from_organization_id": null,
    "inherits_from_parent": false,
    "inherited_fields": null
  },
  "meta": {
    "request_id": "req_branden",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

{
  "data": {
    "logo_url": "https://cdn.example.com/acme/logo.png",
    "logomark_url": "https://cdn.example.com/acme/logomark.svg",
    "primary_color": "#5B2AC3",
    "accent_color": "#F59E0B",
    "dashboard_name": "Acme Support",
    "support_email": "support@acme.example.com",
    "custom_domain": "support.acme.example.com",
    "favicon_url": "https://cdn.example.com/acme/favicon.ico",
    "terms_url": "https://acme.example.com/terms",
    "privacy_url": "https://acme.example.com/privacy",
    "organization_id": "org_01HZQX4E7JQ4M2E2H2DM9XE5",
    "inherited_from_organization_id": null,
    "inherits_from_parent": false,
    "inherited_fields": null
  },
  "meta": {
    "request_id": "req_branden",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Resolve the effective branding for your tenant

One read returns the branding your dashboard, hosted sign-in page, and white-label surfaces should render with. The resolver walks a three-step chain — your own settings first, your reseller parent second, the platform default theme last — and answers it in one envelope so no surface needs a second round-trip.

{
  "data": {
    "logo_url": "https://cdn.example.com/acme/logo.png",
    "logomark_url": "https://cdn.example.com/acme/logomark.svg",
    "primary_color": "#5B2AC3",
    "accent_color": "#F59E0B",
    "dashboard_name": "Acme Support",
    "support_email": "support@acme.example.com",
    "custom_domain": "support.acme.example.com",
    "favicon_url": "https://cdn.example.com/acme/favicon.ico",
    "terms_url": "https://acme.example.com/terms",
    "privacy_url": "https://acme.example.com/privacy",
    "organization_id": "org_01HZQX4E7JQ4M2E2H2DM9XE5",
    "inherited_from_organization_id": null,
    "inherits_from_parent": false,
    "inherited_fields": null
  },
  "meta": {
    "request_id": "req_branden",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Every field is returned; a field you never set (and a parent, if any, never set) comes back null, which signals “fall back to the platform default theme.”

Resolution chain

Tenant override wins. Fields you set directly — under Settings → Branding in the dashboard, or via the organization branding API — are self-authoritative.
Reseller parent fills the gaps. For a subaccount with inherits_from_parent: true, any unset field is pulled from the parent organization. inherited_from_organization_id names the org that supplied values, and inherited_fields maps each inherited field to that org, so the dashboard can badge “Inherited from Acme HQ.”
Null means platform default. A field still null after both steps renders with the unbranded default theme — the merger never invents a value.

The help-center theming fields (help_logo_url, help_primary_color, help_secondary_color, help_header_links, help_show_powered_by) are returned on the same record; they control the public help center and join the chain exactly like the dashboard fields. When branding cannot be resolved — a transient database blip, or a subdomain that is still provisioning — the read still returns 200 with every field nulled, so the shell your authenticating user is waiting on never fails to render.

The response carries Cache-Control: private, max-age=60. Cache it for a minute per client rather than polling on every render.

Custom domains before a session exists

The same resolution powers your white-labelled sign-in page. The page passes its domain in X-Tenant-Host — no API key — and receives the resolved branding of the tenant that registered that domain, so custom.acme.example.com shows your logo and palette before anyone signs in. custom_domain in the response names the registered domain. That unsigned path is IP-rate-limited at a lower ceiling than authenticated calls; the resolution chain above is unchanged.

API Reference

All Endpoints

Resolve the effective branding for your tenant