@Override
    public ContractBean createContract(String organizationId, String clientId, String version, NewContractBean bean)
        throws OrganizationNotFoundException, ClientNotFoundException, ApiNotFoundException, PlanNotFoundException, ContractAlreadyExistsException, NotAuthorizedException {
        // We need to be careful to check both sides of the contract for permissions, as they may be from different organizations.
        // 1. Does the user have the right to modify clients the client org
        securityContext.checkPermissions(PermissionType.clientEdit, organizationId);
        boolean hasApiOrgPermissions = securityContext.hasAllPermissions(Set.of(PermissionType.apiView, PermissionType.planView), bean.getApiOrgId());
        // 2. Does the user have the right to see the API Plan in the API org explicitly or implicitly.
        if (hasApiOrgPermissions || isDiscoverable(bean)) {
            return contractService.createContract(organizationId, clientId, version, bean);
        } else {
            throw ExceptionFactory.notAuthorizedException();
        }
    }
REST layer for Organization

TODO(msavy): split this into multiple interfaces & impls (ApiResource, ClientAppResource, etc).

@author eric.wittmann@redhat.com
@author marc@blackparrotlabs.io
manager/api/rest-impl/src/main/java/io/apiman/manager/api/rest/impl/OrganizationResourceImpl.java