From a18d5b66bfa25e584f43e15b3694347a3159e192 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Wed, 1 Apr 2026 06:57:40 -0400
Subject: [PATCH] fix: don't send x-mc-account header for tenant-specific
 credentials

getMimecastClientForTenant now always uses accountCode='' so the
x-mc-account header is never sent. Sending your own account code
with tenant-specific OAuth credentials causes Mimecast to 403
(it interprets it as an invalid impersonation attempt).
---
 lib/services/mimecast-client.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/services/mimecast-client.ts b/lib/services/mimecast-client.ts
index d3c5ecf..80d4cc7 100644
--- a/lib/services/mimecast-client.ts
+++ b/lib/services/mimecast-client.ts
@@ -569,12 +569,11 @@ export function getMimecastClientForTenant(tenant: {
   client_id: string;
   client_secret: string;
   base_url?: string;
-  account_code?: string;
 }): MimecastClient {
   return new MimecastClient({
     clientId: tenant.client_id,
     clientSecret: tenant.client_secret,
     baseUrl: tenant.base_url ?? 'https://api.services.mimecast.com',
-    accountCode: tenant.account_code ?? '',
+    accountCode: '',
   });
 }