Get My Company

The signed-in account's company page, or an unsaved default.

Never 404s, exactly as GET /api/profile never does: the client is rendering an editor and an editor needs an object to bind to. Building that object in the frontend instead would define the shape of a company in two places, and the day a field is added the two disagree.

Not gated on account_kind. The kind decides which onboarding an account is shown and which page the product nudges it towards; it is not an entitlement, and refusing to hand somebody their own (possibly already saved) company row because a flag says "individual" would make the ordering of two unrelated calls load-bearing and could lock an account out of a page it already owns. Roles are gated -- see company_account -- because that is where the kind genuinely decides what the account is doing.

Nothing is written except a missing API key on a company that already exists. A read that created a row would mean opening the editor and closing it claimed a handle forever. Filling a null key does not claim anything: the page was already saved, and Settings has to be able to show the key.