Register a company under this organization

ADMIN and above, which is ADR 0016 point 7's assignment of companies rather than this route's opinion. Nothing here proves the caller controls the RUC and nothing needs to: the claim confers nothing until a certificate this platform signed with has been accepted by SUNAT, which is proof of control checked by the party that can perform it. What the alta does guarantee is attribution -- it writes an ops.audit_events row naming the person, in the same transaction as the company -- so a squatted RUC is an operator action with evidence rather than an argument between two customers. Every refusal about WHO the caller is answers 409 MEMBERSHIP_CHANGE_REFUSED indistinguishably; only a RUC already registered answers something specific, and it says nothing about whose it is.

curl -X POST "https://example.com/console/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/companies" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "ruc": "string",    "legalName": "string",    "environment": "BETA"  }'

{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda",  "ruc": "string",  "legalName": "string",  "status": "ACTIVE",  "environment": "BETA",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "createdAt": "2019-08-24T14:15:22Z"}