Everything is scoped to one employer

Every application is approved against exactly one Rolefy employer, never "all of Rolefy's employers". There is no endpoint that lists or looks up employers: your credentials already identify which one you are, so every resource below (jobs, applications, webhooks) is scoped to it automatically. Within that employer, your application only sees and changes the jobs it created itself, and the applications to those jobs. Jobs the employer posted on Rolefy by hand are not visible to it. A job or application id that belongs to anyone else returns a plain 404, the same response you would get if it didn't exist.