The descriptions of the operations and fields are the contract’s own, in English.
/metering/v1/status/checkpointRead the C3 cursors for a stream scope
- Credential
- API key
- Permission
usage.read
Reads the C3 status fields the metering domain owns for one (tenant, plane instance, stream) scope. The response is the closed 8-field metering C3 projection: kind (const status), the three scope slugs, contiguous_usage_through, usage_high_water, and exactly last_ship_age_seconds and chain_head null (C3-nullable, not metering-owned); every other C3 field is absent. A scope the pipeline has never observed is 404 checkpoint-not-found.
curl "https://console.eu.ccsio.ai/metering/v1/status/checkpoint?tenant_id=<tenant_id>&plane_instance_id=<plane_instance_id>&stream_id=<stream_id>" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
tenant_idrequired | query | string The tenant identifier (C2/C8 slug pattern). |
plane_instance_idrequired | query | string The plane instance identifier (C2/C8 slug pattern). |
stream_idrequired | query | string The stream identifier (C2/C8 slug pattern). |
Responses
- 200
The metering-owned C3 projection for the scope.
Schema
StatusCheckpointViewkindanyrequiredalways "status"
tenant_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
plane_instance_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
stream_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
contiguous_usage_throughintegerrequired0 to 9007199254740991
usage_high_waterintegerrequired0 to 9007199254740991
last_ship_age_secondsnull or nullrequiredchain_headnull or nullrequired
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
/metering/v1/status/degradationRead the per-(measurement, reason) degraded-usage aggregate
- Credential
- API key
- Permission
usage.read
Reads the per-(measurement, measurement_reason) count of usage facts in a window — the operator signal for how much usage was not exactly measured, and why. since is an optional RFC 3339 query parameter (default: 24 h before now); a present-but-malformed value is 400 invalid-request.
Read more
The window_start echoes the truncated UTC value. Rows are ordered by (measurement, reason), bounded by the C2 enum cardinality (3 measurements x 6 reasons), render [] when empty (never null), and carry reason null exactly for measured facts.
curl "https://console.eu.ccsio.ai/metering/v1/status/degradation" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
sinceoptional | query | string RFC 3339, any offset; the read echoes the truncated UTC value; default window 24 h before now. |
Responses
- 200
The degradation aggregate for the window.
Schema
DegradationViewwindow_startstringrequiredpattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$
rowsarray of DegradationRowrequiredmeasurementstringrequiredAllowed values:
"measured""estimated""unknown"reasonstring or nullrequiredThe degradation reason; null exactly for measured facts.
Allowed values:
"coarse_counter""provider_estimate""final_usage_missing""meter_loss""canceled""implausible_count"countintegerrequiredat least 0
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
Generated from the platform contracts at commit 5f833620.