Skip to main content
API reference
DocumentationIdentity and access · console.latam.ccsio.ai

Entitlements

The models and capabilities an organization holds, and how it distributes them across its teams.

Documentation menu

The descriptions of the operations and fields are the contract’s own, in English.

GET/identity/v1/organizations/{org}/entitlements

List an organization's active entitlements

Credential
API key
Permission
entitlements.read

Returns the organization's own ACTIVE, organization-scoped entitlement set (revoked rows are tombstones, never active; a team's own entitlements are listed on the team). No request body. Failures: 400 name-invalid (an organization id outside the C7 pattern); 404 organization-not-found (the organization is unknown — a 404, not an empty list); 500 server faults. Needs entitlements.read in the route's organization; a platform operator holds it at platform level.

curl
curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Responses

  • 200

    The organization's active entitlement views.

    Schema
    ListEntitlementsResponseDetail
    • entitlementsarray of EntitlementDetailrequired
      • org_idstringrequired

        The organization id (C7 identifier).

        pattern ^[a-z][a-z0-9._-]{0,63}$

      • team_idstring or nullrequired

        null = organization-scoped; a C7 team id = team-scoped.

        pattern ^[a-z][a-z0-9._-]{0,63}$

      • capabilitystringrequired

        The entitlement capability, one of the four closed families.

        Allowed values: "model_access""brain_capacity""billing_state""feature"

      • model_refstringrequired

        The C0 model reference; empty unless capability=model_access.

      • feature_keystringrequired

        The feature key, a closed vocabulary; empty unless capability=feature.

        Allowed values: """memory.connectors""memory.zero_content_retention"

      • capacity_quantityintegerrequired

        Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

        at least 0

      • capacity_unitstringrequired

        Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

        Allowed values: """gb"

      • statestringrequired

        The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

        Allowed values: "active""revoked"

      • created_atstring (date-time)required

        RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/entitlements/{capability}

Read one active entitlement

Credential
API key
Permission
entitlements.read

Reads one stored row of the organization's ACTIVE set by capability (and model_ref, query-carried, for model_access, or feature_key, query-carried, for feature). No request body.

Read more

Failures: 400 name-invalid (an organization id outside the C7 pattern); 404 organization-not-found (the organization is unknown), 404 entitlement-not-found (an absent or revoked entitlement; a capability outside the four families, or a member that does not go with the family, finds none and is answered the same way); 500 server faults.

curl
curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/entitlements/{capability}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

capability
required
pathstring

The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.

model_ref
optional
querystring

The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.

feature_key
optional
querystring

The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Responses

  • 200

    The entitlement view in state active.

    Schema
    EntitlementDetail
    • org_idstringrequired

      The organization id (C7 identifier).

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullrequired

      null = organization-scoped; a C7 team id = team-scoped.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • capabilitystringrequired

      The entitlement capability, one of the four closed families.

      Allowed values: "model_access""brain_capacity""billing_state""feature"

    • model_refstringrequired

      The C0 model reference; empty unless capability=model_access.

    • feature_keystringrequired

      The feature key, a closed vocabulary; empty unless capability=feature.

      Allowed values: """memory.connectors""memory.zero_content_retention"

    • capacity_quantityintegerrequired

      Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

      at least 0

    • capacity_unitstringrequired

      Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

      Allowed values: """gb"

    • statestringrequired

      The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

      Allowed values: "active""revoked"

    • created_atstring (date-time)required

      RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/teams/{team}/entitlements

List one team's own active entitlements

Credential
API key
Permission
entitlements.read

Returns exactly this team's own active, team-scoped entitlements: never the organization-scoped set (GET .../entitlements lists that) and never another team's. The team's existence is checked: an unknown team is 404, not an empty list.

Read more

Needs entitlements.read for the team: the team's own administrator may read it, as may an organization-wide administrator or a platform ccsio_admin. Failures: 400 name-invalid; 404 team-not-found (an unknown team, or an unknown organization); 500 server faults.

curl
curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

team
required
pathstring

The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Responses

  • 200

    This team's own active entitlements.

    Schema
    ListEntitlementsResponseDetail
    • entitlementsarray of EntitlementDetailrequired
      • org_idstringrequired

        The organization id (C7 identifier).

        pattern ^[a-z][a-z0-9._-]{0,63}$

      • team_idstring or nullrequired

        null = organization-scoped; a C7 team id = team-scoped.

        pattern ^[a-z][a-z0-9._-]{0,63}$

      • capabilitystringrequired

        The entitlement capability, one of the four closed families.

        Allowed values: "model_access""brain_capacity""billing_state""feature"

      • model_refstringrequired

        The C0 model reference; empty unless capability=model_access.

      • feature_keystringrequired

        The feature key, a closed vocabulary; empty unless capability=feature.

        Allowed values: """memory.connectors""memory.zero_content_retention"

      • capacity_quantityintegerrequired

        Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

        at least 0

      • capacity_unitstringrequired

        Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

        Allowed values: """gb"

      • statestringrequired

        The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

        Allowed values: "active""revoked"

      • created_atstring (date-time)required

        RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/entitlements

Grant a team an entitlement

Credential
API key
Permission
team-entitlements.manage
Request body
Body up to 1 MiB

Allocates part of what the organization holds to one of its teams: never more than the organization itself holds, which is enforced server-side.

Read more

Needs team-entitlements.manage in the organization (the Root and Organization Admin roles hold it; a team's own administrator does not), unlike the organization-scoped create, which is a platform operator's. A presence capability (model_access, feature) requires the organization to hold the same model or feature actively (a model it reaches through a model group counts); brain_capacity requires the sum of every team's active share, this one included, to be at most the organization's own quantity. billing_state is organization-only and cannot be team-scoped. The body is the one of the organization-scoped create; the team always comes from the path, never from the body. Idempotent upsert: granting what the team already holds returns it, re-creating a revoked entitlement re-activates it, and brain_capacity's quantity and unit are overwritten by a re-create (the one deliberate deviation from pure idempotency). Failures: 400 invalid-request (capability missing, a member present or absent against the family, or an unknown member); 400 name-invalid (organization or team outside the C7 pattern); 400 entitlement-invalid (a capability, feature key, capacity, unit or model reference outside its closed vocabulary or pattern, or billing_state); 404 organization-not-found; 404 entitlement-team-not-found (the team does not exist in this organization); 409 entitlement-exceeds-organization (the grant would exceed what the organization holds); 500 server faults.

curl
curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "capability": "model_access"
}'
Built from the schema’s required members: replace the values.

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

team
required
pathstring

The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Request body application/json

CreateEntitlementRequestDetail
  • capabilitystringrequired

    The entitlement capability, one of the four closed families. A value outside the taxonomy is refused with 400 entitlement-invalid.

    Allowed values: "model_access""brain_capacity""billing_state""feature"

  • model_refstringoptional

    The C0 model reference, required for model_access and forbidden otherwise. PRESENCE is a request-shape check (400 invalid-request); the pattern and the taxonomy are the domain's (400 entitlement-invalid).

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • feature_keystringoptional

    The feature key, required for feature and forbidden otherwise. Its presence is a request-shape check (400 invalid-request); the closed vocabulary is the domain's (400 entitlement-invalid).

    Allowed values: "memory.connectors""memory.zero_content_retention"

  • capacity_quantityintegeroptional

    Brain capacity's amount, required (and > 0) for brain_capacity and forbidden otherwise. Its presence is a request-shape check (400 invalid-request); the positive-value rule is the domain's (400 entitlement-invalid).

    at least 1

  • capacity_unitstringoptional

    Brain capacity's unit, required for brain_capacity and forbidden otherwise (gigabytes of indexed content; provisional, and the only unit today).

    Allowed values: "gb"

Responses

  • 200

    The team-scoped entitlement, in state active.

    Schema
    EntitlementDetail
    • org_idstringrequired

      The organization id (C7 identifier).

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullrequired

      null = organization-scoped; a C7 team id = team-scoped.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • capabilitystringrequired

      The entitlement capability, one of the four closed families.

      Allowed values: "model_access""brain_capacity""billing_state""feature"

    • model_refstringrequired

      The C0 model reference; empty unless capability=model_access.

    • feature_keystringrequired

      The feature key, a closed vocabulary; empty unless capability=feature.

      Allowed values: """memory.connectors""memory.zero_content_retention"

    • capacity_quantityintegerrequired

      Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

      at least 0

    • capacity_unitstringrequired

      Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

      Allowed values: """gb"

    • statestringrequired

      The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

      Allowed values: "active""revoked"

    • created_atstring (date-time)required

      RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 409

    The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

  • 500

    Platform failure, rendered without internal cause details.

GET/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}

Read one of a team's own entitlements

Credential
API key
Permission
entitlements.read

Reads one of the team's own active entitlements by capability (path-carried), with model_ref for model_access or feature_key for feature in the query: the same members that identify the entitlement when it is granted.

Read more

A read names a stored entitlement, so a capability outside the four families, a member that does not go with the family, an entitlement the team does not hold, an unknown team, and an entitlement that was revoked all find none: 404 entitlement-not-found. Needs entitlements.read for the team. Failures: 400 name-invalid (organization or team outside the C7 pattern); 404 organization-not-found; 404 entitlement-not-found; 500 server faults.

curl
curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

team
required
pathstring

The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

capability
required
pathstring

The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.

model_ref
optional
querystring

The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.

feature_key
optional
querystring

The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Responses

  • 200

    This team's own active entitlement of the capability.

    Schema
    EntitlementDetail
    • org_idstringrequired

      The organization id (C7 identifier).

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullrequired

      null = organization-scoped; a C7 team id = team-scoped.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • capabilitystringrequired

      The entitlement capability, one of the four closed families.

      Allowed values: "model_access""brain_capacity""billing_state""feature"

    • model_refstringrequired

      The C0 model reference; empty unless capability=model_access.

    • feature_keystringrequired

      The feature key, a closed vocabulary; empty unless capability=feature.

      Allowed values: """memory.connectors""memory.zero_content_retention"

    • capacity_quantityintegerrequired

      Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

      at least 0

    • capacity_unitstringrequired

      Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

      Allowed values: """gb"

    • statestringrequired

      The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

      Allowed values: "active""revoked"

    • created_atstring (date-time)required

      RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}/revoke

Revoke one of a team's own entitlements

Credential
API key
Permission
team-entitlements.manage

Moves one of the team's own entitlements from active to revoked: a tombstone, never a physical delete, so the revocation stays auditable.

Read more

Idempotent: revoking one that is already revoked returns it again, in state revoked. capability is path-carried and model_ref or feature_key ride the query, exactly as for the read. Needs team-entitlements.manage in the organization, the same authorization as the grant. Failures: 400 name-invalid; 404 organization-not-found; 404 entitlement-not-found (the team holds no such entitlement, active or revoked; a capability outside the four families finds none); 500 server faults.

curl
curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/entitlements/{capability}/revoke" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

org
required
pathstring

The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

team
required
pathstring

The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

capability
required
pathstring

The entitlement capability, path-carried because it is a closed enum. One of the four families: model_access, brain_capacity, billing_state, feature. A read or a revoke names a stored entitlement, so a value outside the four (or a member that does not go with the family) finds none and is answered 404 entitlement-not-found, not as a malformed request.

model_ref
optional
querystring

The entitlement's C0 model reference, query-carried because a C0 ref may contain '/' and ':' (path segments would mangle them into several tokens). Present for model_access; absent for every other family.

feature_key
optional
querystring

The feature key: required when capability is feature, forbidden otherwise (400 entitlement-invalid).

Responses

  • 200

    The revoked (tombstoned) entitlement.

    Schema
    EntitlementDetail
    • org_idstringrequired

      The organization id (C7 identifier).

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullrequired

      null = organization-scoped; a C7 team id = team-scoped.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • capabilitystringrequired

      The entitlement capability, one of the four closed families.

      Allowed values: "model_access""brain_capacity""billing_state""feature"

    • model_refstringrequired

      The C0 model reference; empty unless capability=model_access.

    • feature_keystringrequired

      The feature key, a closed vocabulary; empty unless capability=feature.

      Allowed values: """memory.connectors""memory.zero_content_retention"

    • capacity_quantityintegerrequired

      Brain capacity's amount; 0 unless capability=brain_capacity, where it is always > 0.

      at least 0

    • capacity_unitstringrequired

      Brain capacity's unit (gigabytes of indexed content; provisional, and the only unit today); empty unless capability=brain_capacity.

      Allowed values: """gb"

    • statestringrequired

      The entitlement state: active (part of the scope's active set) or revoked (the tombstone).

      Allowed values: "active""revoked"

    • created_atstring (date-time)required

      RFC 3339, second precision, UTC.

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

Generated from the platform contracts at commit 5f833620.

Explore the platform

Get your first API key

Registration is open. Four steps to your first call: create your account, create your organization, create your API key, and start using it.

  1. 01Create your account
  2. 02Create your organization
  3. 03Create your API key
  4. 04Start using it
Create accountTalk to us