diff --git a/api/v1/assets/update.php b/api/v1/assets/update.php
index db90b3e52..58e15684b 100644
--- a/api/v1/assets/update.php
+++ b/api/v1/assets/update.php
@@ -21,7 +21,7 @@ if (!empty($asset_id)) {
     $update_sql = mysqli_query($mysqli, "UPDATE assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_status = '$status', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_notes = '$notes' WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
-    if ($update_sql) {
+    if ($update_sql && $asset_row) {
         $update_count = mysqli_affected_rows($mysqli);
 
         // Update Primary Interface
diff --git a/api/v1/contacts/update.php b/api/v1/contacts/update.php
index c21ba9c5e..3dd27a693 100644
--- a/api/v1/contacts/update.php
+++ b/api/v1/contacts/update.php
@@ -23,7 +23,7 @@ if (!empty($contact_id)) {
         mysqli_query($mysqli,"UPDATE contacts SET contact_primary = 0 WHERE contact_client_id = $client_id");
     }
 
-    $update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile',  contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id LIMIT 1");
+    $update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile',  contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
     if ($update_sql) {
diff --git a/api/v1/credentials/update.php b/api/v1/credentials/update.php
index 049a02f07..a800253cb 100644
--- a/api/v1/credentials/update.php
+++ b/api/v1/credentials/update.php
@@ -20,7 +20,7 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($credential_id)) {
     $update_sql = mysqli_query($mysqli,"UPDATE credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id WHERE credential_id = '$credential_id' AND credential_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
-    if ($update_sql) {
+    if ($update_sql && $credential_row) {
         $update_count = mysqli_affected_rows($mysqli);
 
         if ($password_changed) {
diff --git a/api/v1/expenses/read.php b/api/v1/expenses/read.php
index ddcd47c77..3bbb05779 100644
--- a/api/v1/expenses/read.php
+++ b/api/v1/expenses/read.php
@@ -5,18 +5,16 @@ require_once '../validate_api_key.php';
 require_once '../require_get_method.php';
 
 
-// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php
-
 if (isset($_GET['expense_id'])) {
     // Expense via ID (single)
 
     $id = intval($_GET['expense_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id' AND 1=1 " . apiClientScopeSql('expense_client_id') . "");
 
 } else {
     // All expenses
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE 1=1 " . apiClientScopeSql('expense_client_id') . " ORDER BY expense_id LIMIT $limit OFFSET $offset");
 }
 
 // Output