Entitlements

Die Beschreibungen der Operationen und Felder stammen aus dem Vertrag und sind auf Englisch.

GET/identity/v1/organizations/{org}/entitlements

List an organization's active entitlements

Anmeldedaten: API-Key
Berechtigung: entitlements.read

Returns the organization's own ACTIVE, organization-scoped entitlement set (revoked rows are tombstones, never active; a team's own entitlements are listed on the team). No request body. Failures: 400 name-invalid (an organization id outside the C7 pattern); 404 organization-not-found (the organization is unknown — a 404, not an empty list); 500 server faults. Needs entitlements.read in the route's organization; a platform operator holds it at platform level.

curl

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Antworten

200
The organization's active entitlement views.
Schema
ListEntitlementsResponseDetail
entitlementsarray of EntitlementDetailPflicht
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/entitlements/{capability}

Read one active entitlement

Anmeldedaten: API-Key
Berechtigung: entitlements.read

Reads one stored row of the organization's ACTIVE set by capability (and model_ref, query-carried, for model_access, or feature_key, query-carried, for feature). No request body.

Failures: 400 name-invalid (an organization id outside the C7 pattern); 404 organization-not-found (the organization is unknown), 404 entitlement-not-found (an absent or revoked entitlement; a capability outside the four families, or a member that does not go with the family, finds none and is answered the same way); 500 server faults.

curl

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/entitlements/{capability}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`capability` Pflicht	path	string The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.
`model_ref` optional	query	string The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.
`feature_key` optional	query	string The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Antworten

200
The entitlement view in state active.
Schema
EntitlementDetail
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/teams/{team}/entitlements

List one team's own active entitlements

Anmeldedaten: API-Key
Berechtigung: entitlements.read

Returns exactly this team's own active, team-scoped entitlements: never the organization-scoped set (GET .../entitlements lists that) and never another team's. The team's existence is checked: an unknown team is 404, not an empty list.

Needs entitlements.read for the team: the team's own administrator may read it, as may an organization-wide administrator or a platform ccsio_admin. Failures: 400 name-invalid; 404 team-not-found (an unknown team, or an unknown organization); 500 server faults.

curl

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` Pflicht	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Antworten

200
This team's own active entitlements.
Schema
ListEntitlementsResponseDetail
entitlementsarray of EntitlementDetailPflicht
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/entitlements

Grant a team an entitlement

Anmeldedaten: API-Key
Berechtigung: team-entitlements.manage
Request-Body: Body bis 1 MiB

Allocates part of what the organization holds to one of its teams: never more than the organization itself holds, which is enforced server-side.

Needs team-entitlements.manage in the organization (the Root and Organization Admin roles hold it; a team's own administrator does not), unlike the organization-scoped create, which is a platform operator's. A presence capability (model_access, feature) requires the organization to hold the same model or feature actively (a model it reaches through a model group counts); brain_capacity requires the sum of every team's active share, this one included, to be at most the organization's own quantity. billing_state is organization-only and cannot be team-scoped. The body is the one of the organization-scoped create; the team always comes from the path, never from the body. Idempotent upsert: granting what the team already holds returns it, re-creating a revoked entitlement re-activates it, and brain_capacity's quantity and unit are overwritten by a re-create (the one deliberate deviation from pure idempotency). Failures: 400 invalid-request (capability missing, a member present or absent against the family, or an unknown member); 400 name-invalid (organization or team outside the C7 pattern); 400 entitlement-invalid (a capability, feature key, capacity, unit or model reference outside its closed vocabulary or pattern, or billing_state); 404 organization-not-found; 404 entitlement-team-not-found (the team does not exist in this organization); 409 entitlement-exceeds-organization (the grant would exceed what the organization holds); 500 server faults.

curl

curl -X POST "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "capability": "model_access"
}'

Aus den Pflichtfeldern des Schemas erzeugt: ersetze die Werte.

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` Pflicht	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Request-Body application/json

CreateEntitlementRequestDetail

capabilitystringPflicht
The entitlement capability, one of the four closed families. A value outside the taxonomy is refused with 400 entitlement-invalid.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringoptional
The C0 model reference, required for model_access and forbidden otherwise. PRESENCE is a request-shape check (400 invalid-request); the pattern and the taxonomy are the domain's (400 entitlement-invalid).
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
feature_keystringoptional
The feature key, required for feature and forbidden otherwise. Its presence is a request-shape check (400 invalid-request); the closed vocabulary is the domain's (400 entitlement-invalid).
Erlaubte Werte: "memory.connectors""memory.zero_content_retention"
capacity_quantityintegeroptional
Brain capacity's amount, required (and > 0) for brain_capacity and forbidden otherwise. Its presence is a request-shape check (400 invalid-request); the positive-value rule is the domain's (400 entitlement-invalid).
at least 1
capacity_unitstringoptional
Brain capacity's unit, required for brain_capacity and forbidden otherwise (gigabytes of indexed content; provisional, and the only unit today).
Erlaubte Werte: "gb"

Antworten

200
The team-scoped entitlement, in state active.
Schema
EntitlementDetail
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
500
Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}

Read one of a team's own entitlements

Anmeldedaten: API-Key
Berechtigung: entitlements.read

Reads one of the team's own active entitlements by capability (path-carried), with model_ref for model_access or feature_key for feature in the query: the same members that identify the entitlement when it is granted.

A read names a stored entitlement, so a capability outside the four families, a member that does not go with the family, an entitlement the team does not hold, an unknown team, and an entitlement that was revoked all find none: 404 entitlement-not-found. Needs entitlements.read for the team. Failures: 400 name-invalid (organization or team outside the C7 pattern); 404 organization-not-found; 404 entitlement-not-found; 500 server faults.

curl

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` Pflicht	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`capability` Pflicht	path	string The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.
`model_ref` optional	query	string The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.
`feature_key` optional	query	string The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Antworten

200
This team's own active entitlement of the capability.
Schema
EntitlementDetail
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}/revoke

Revoke one of a team's own entitlements

Anmeldedaten: API-Key
Berechtigung: team-entitlements.manage

Moves one of the team's own entitlements from active to revoked: a tombstone, never a physical delete, so the revocation stays auditable.

Idempotent: revoking one that is already revoked returns it again, in state revoked. capability is path-carried and model_ref or feature_key ride the query, exactly as for the read. Needs team-entitlements.manage in the organization, the same authorization as the grant. Failures: 400 name-invalid; 404 organization-not-found; 404 entitlement-not-found (the team holds no such entitlement, active or revoked; a capability outside the four families finds none); 500 server faults.

curl

curl -X POST "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}/revoke" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Name	In	Beschreibung
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` Pflicht	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` Pflicht	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`capability` Pflicht	path	string The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.
`model_ref` optional	query	string The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.
`feature_key` optional	query	string The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Antworten

200
The revoked (tombstoned) entitlement.
Schema
EntitlementDetail
org_idstringPflicht
The organization id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstring or nullPflicht
null = organization-scoped; a C7 team id = team-scoped.
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitystringPflicht
The entitlement capability, one of the four closed families.
Erlaubte Werte: "model_access""brain_capacity""billing_state""feature"
model_refstringPflicht
The C0 model reference; empty unless capability=model_access.
feature_keystringPflicht
The feature key, a closed vocabulary; empty unless capability=feature.
Erlaubte Werte: """memory.connectors""memory.zero_content_retention"
capacity_quantityintegerPflicht
Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.
at least 0
capacity_unitstringPflicht
Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.
Erlaubte Werte: """gb"
statestringPflicht
The entitlement state: active (part of the scope's active set) or revoked (the tombstone).
Erlaubte Werte: "active""revoked"
created_atstring (date-time)Pflicht
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Weiterlesen
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Weiterlesen
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Weiterlesen
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Erzeugt aus den Plattformverträgen beim Commit 5f833620.

List an organization's active entitlements

Parameter

Antworten

Read one active entitlement

Parameter

Antworten

List one team's own active entitlements

Parameter

Antworten

Grant a team an entitlement

Parameter

Request-Body application/json

Antworten

Read one of a team's own entitlements

Parameter

Antworten

Revoke one of a team's own entitlements

Parameter

Antworten

Deinen ersten API-Key holen