What server are you using? a locally-installed server?
OK, so the company you're referring to is encoded in the authorization header
Well, for some reason the webserver auth user entry is probably created using the incorrect company_id - the best thing to do it exec into the mongo container and check the actual company value assigned to the webserver user