diff --git a/src/lib/api/api.ts b/src/lib/api/api.ts index c55ac23c..7765a6e7 100644 --- a/src/lib/api/api.ts +++ b/src/lib/api/api.ts @@ -67,11 +67,10 @@ export const get_ae_obj_li_for_lu = async function get_ae_obj_li_for_lu({ console.log(`*** get_ae_obj_li_for_lu() *** for_lu_type=${for_lu_type}`); } - // Lookup data is global; bypass account-id scope check - const merged_headers = { - 'x-no-account-id': 'Nothing to See Here', - ...headers - }; + // Pass headers as-is — get_object will auto-promote the real account_id from api_cfg. + // Do NOT use x-no-account-id bypass: the backend hardcodes account_id=1 for that path, + // which leaks account-scoped lookup overrides to all callers. + const merged_headers = { ...headers }; // Use V3 system for primary lookup types if (['country', 'country_subdivision', 'time_zone'].includes(for_lu_type)) {