Multi-level question:

A) I've read a lot of documentation and the more I read the more confused I become.

There is no clear answer what the tenant is in term of relation to the admin panel. Is the integrated app a tenant (e.g. "My Web App" which uses okta as auth provider)? Or is it a group inside the organization? Term is used in so many places without defining direct correlation with available tools.

My situation is that I want to set up auth providers for different applications that have different user bases (different users should have access to them but some of them should have access to many) and this situation can be resolved by assigning accounts to specific groups that are assigned to integrated applications scope or assigning accounts by themselves - all in the same organization.

B) Problem occurs when I want to be able to create accounts from different applications via API. I can generate token that will act as authentication for API calls but it can be used 'globally'. Is there any way that auth SSWS token can authenticate creation, assignment, deactivating and getting users that are only assigned to certain group or/and application?