Access requests

What the organization holds and how one team stands with each

Credencial

API key

Permiso

teams.update

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/access" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organization's models and MCP servers with the team's standing.

  Esquema

  TeamAccess

  • organization_idstringobligatorio

    The organization (the path value).

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstringobligatorio

    The team (the path value).

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • itemsarray of TeamAccessItemobligatorio

    • kindstringobligatorio

      Valores permitidos: "model""mcp_server"

    • subjectstringobligatorio

      The model reference, or the MCP server's alias.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • titlestring or nullobligatorio

      An MCP server's title; null for a model, whose reference is its name.

    • standingstringobligatorio

      every_team: nothing restricts it, so every team is served. this_team: it is restricted to teams and this is one of them. other_teams: it is restricted to teams and this is not one of them; the only standing that can be asked for.

      Valores permitidos: "every_team""this_team""other_teams"

    • pending_request_idstring or nullobligatorio

      The team's pending access request for this item; null when it has none.

      pattern ^[0-9A-HJKMNP-TV-Z]{26}$

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

List one team's access requests

Credencial

API key

Permiso

teams.update

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/access-requests" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The team's requests.

  Esquema

  ListAccessRequestsResponse

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • access_requestsarray of AccessRequestobligatorio

    • idstringobligatorio

      pattern ^[0-9A-HJKMNP-TV-Z]{26}$

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_namestring or nullobligatorio

      The team's name when the request is read; null when the team is not known any more.

    • kindstringobligatorio

      Valores permitidos: "model""mcp_server"

    • subjectstringobligatorio

      The model reference or the MCP server's alias, as it was named when the request was made.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • reasonstringobligatorio

      The requester's own words; empty when none were given.

      at most 500 characters

    • statusstringobligatorio

      pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

      Valores permitidos: "pending""approved""rejected""canceled"

    • requested_bystringobligatorio

      The requester's principal reference.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • requester_emailstring or nullobligatorio

      Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

    • requester_namestring or nullobligatorio

      Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

    • requested_atstring (date-time)obligatorio

      RFC 3339, UTC; the time may carry fractional seconds.

    • decided_bystring or nullobligatorio

      Who approved, rejected or canceled it; null while it is pending.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • decider_emailstring or nullobligatorio

      Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

    • decider_namestring or nullobligatorio

      Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

    • decided_atstring (date-time) or nullobligatorio

      When it was decided; null while it is pending.

    • decision_notestringobligatorio

      The decider's own words; empty when none were given.

      at most 500 characters

    • decidablebooleanobligatorio

      Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Ask for a model or an MCP server for one team

Credencial

API key

Permiso

teams.update

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/access-requests" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "model",
  "subject": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The pending request.

  Esquema

  AccessRequest

  • idstringobligatorio

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_namestring or nullobligatorio

    The team's name when the request is read; null when the team is not known any more.

  • kindstringobligatorio

    Valores permitidos: "model""mcp_server"

  • subjectstringobligatorio

    The model reference or the MCP server's alias, as it was named when the request was made.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • reasonstringobligatorio

    The requester's own words; empty when none were given.

    at most 500 characters

  • statusstringobligatorio

    pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

    Valores permitidos: "pending""approved""rejected""canceled"

  • requested_bystringobligatorio

    The requester's principal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • requester_emailstring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

  • requester_namestring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

  • requested_atstring (date-time)obligatorio

    RFC 3339, UTC; the time may carry fractional seconds.

  • decided_bystring or nullobligatorio

    Who approved, rejected or canceled it; null while it is pending.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • decider_emailstring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

  • decider_namestring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

  • decided_atstring (date-time) or nullobligatorio

    When it was decided; null while it is pending.

  • decision_notestringobligatorio

    The decider's own words; empty when none were given.

    at most 500 characters

  • decidablebooleanobligatorio

    Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Withdraw one team's pending request

Credencial

API key

Permiso

teams.update

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/access-requests/{id}/cancel" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The canceled request.

  Esquema

  AccessRequest

  • idstringobligatorio

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_namestring or nullobligatorio

    The team's name when the request is read; null when the team is not known any more.

  • kindstringobligatorio

    Valores permitidos: "model""mcp_server"

  • subjectstringobligatorio

    The model reference or the MCP server's alias, as it was named when the request was made.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • reasonstringobligatorio

    The requester's own words; empty when none were given.

    at most 500 characters

  • statusstringobligatorio

    pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

    Valores permitidos: "pending""approved""rejected""canceled"

  • requested_bystringobligatorio

    The requester's principal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • requester_emailstring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

  • requester_namestring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

  • requested_atstring (date-time)obligatorio

    RFC 3339, UTC; the time may carry fractional seconds.

  • decided_bystring or nullobligatorio

    Who approved, rejected or canceled it; null while it is pending.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • decider_emailstring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

  • decider_namestring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

  • decided_atstring (date-time) or nullobligatorio

    When it was decided; null while it is pending.

  • decision_notestringobligatorio

    The decider's own words; empty when none were given.

    at most 500 characters

  • decidablebooleanobligatorio

    Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

List the organization's access requests

Credencial

API key

Permiso

Cualquiera deteam-entitlements.managemcp.manage

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/access-requests" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organization's requests.

  Esquema

  ListAccessRequestsResponse

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • access_requestsarray of AccessRequestobligatorio

    • idstringobligatorio

      pattern ^[0-9A-HJKMNP-TV-Z]{26}$

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_namestring or nullobligatorio

      The team's name when the request is read; null when the team is not known any more.

    • kindstringobligatorio

      Valores permitidos: "model""mcp_server"

    • subjectstringobligatorio

      The model reference or the MCP server's alias, as it was named when the request was made.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • reasonstringobligatorio

      The requester's own words; empty when none were given.

      at most 500 characters

    • statusstringobligatorio

      pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

      Valores permitidos: "pending""approved""rejected""canceled"

    • requested_bystringobligatorio

      The requester's principal reference.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • requester_emailstring or nullobligatorio

      Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

    • requester_namestring or nullobligatorio

      Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

    • requested_atstring (date-time)obligatorio

      RFC 3339, UTC; the time may carry fractional seconds.

    • decided_bystring or nullobligatorio

      Who approved, rejected or canceled it; null while it is pending.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • decider_emailstring or nullobligatorio

      Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

    • decider_namestring or nullobligatorio

      Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

    • decided_atstring (date-time) or nullobligatorio

      When it was decided; null while it is pending.

    • decision_notestringobligatorio

      The decider's own words; empty when none were given.

      at most 500 characters

    • decidablebooleanobligatorio

      Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Approve a pending request and give the team the access

Credencial

API key

Permiso

Cualquiera deteam-entitlements.managemcp.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/access-requests/{id}/approve" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The approved request.

  Esquema

  AccessRequest

  • idstringobligatorio

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_namestring or nullobligatorio

    The team's name when the request is read; null when the team is not known any more.

  • kindstringobligatorio

    Valores permitidos: "model""mcp_server"

  • subjectstringobligatorio

    The model reference or the MCP server's alias, as it was named when the request was made.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • reasonstringobligatorio

    The requester's own words; empty when none were given.

    at most 500 characters

  • statusstringobligatorio

    pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

    Valores permitidos: "pending""approved""rejected""canceled"

  • requested_bystringobligatorio

    The requester's principal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • requester_emailstring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

  • requester_namestring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

  • requested_atstring (date-time)obligatorio

    RFC 3339, UTC; the time may carry fractional seconds.

  • decided_bystring or nullobligatorio

    Who approved, rejected or canceled it; null while it is pending.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • decider_emailstring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

  • decider_namestring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

  • decided_atstring (date-time) or nullobligatorio

    When it was decided; null while it is pending.

  • decision_notestringobligatorio

    The decider's own words; empty when none were given.

    at most 500 characters

  • decidablebooleanobligatorio

    Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Reject a pending request

Credencial

API key

Permiso

Cualquiera deteam-entitlements.managemcp.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/access-requests/{id}/reject" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The rejected request.

  Esquema

  AccessRequest

  • idstringobligatorio

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_namestring or nullobligatorio

    The team's name when the request is read; null when the team is not known any more.

  • kindstringobligatorio

    Valores permitidos: "model""mcp_server"

  • subjectstringobligatorio

    The model reference or the MCP server's alias, as it was named when the request was made.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • reasonstringobligatorio

    The requester's own words; empty when none were given.

    at most 500 characters

  • statusstringobligatorio

    pending until an administrator of the organization approves or rejects it, or the team's administrator cancels it; the other three states are final.

    Valores permitidos: "pending""approved""rejected""canceled"

  • requested_bystringobligatorio

    The requester's principal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • requester_emailstring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no email.

  • requester_namestring or nullobligatorio

    Resolved when the request is read; null when the directory no longer knows the reference or it has no name.

  • requested_atstring (date-time)obligatorio

    RFC 3339, UTC; the time may carry fractional seconds.

  • decided_bystring or nullobligatorio

    Who approved, rejected or canceled it; null while it is pending.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • decider_emailstring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no email.

  • decider_namestring or nullobligatorio

    Resolved when the request is read; null while pending, or when the directory no longer knows the reference or it has no name.

  • decided_atstring (date-time) or nullobligatorio

    When it was decided; null while it is pending.

  • decision_notestringobligatorio

    The decider's own words; empty when none were given.

    at most 500 characters

  • decidablebooleanobligatorio

    Whether the caller may approve or reject the request now: it is pending and the caller holds the permission that gives its kind of access. Always false in the answer of a create, an approval, a rejection and a cancellation.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)