API keys

List the organization's API keys

Credencial

API key

Permiso

Cualquiera deapi-keys.readsupport-access.read

curl "https://console.latam.ccsio.ai/identity/v1/api-keys?org=<org>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The API-key list (views without raw).

  Esquema

  ListAPIKeysResponse

  • api_keysarray of APIKeyobligatorio

    • key_idstringobligatorio

      The platform-minted key id (uppercase ULID).

      pattern ^[0-9A-HJKMNP-TV-Z]{26}$

    • org_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • namestringobligatorio

      1 to 128 characters

    • principal_refstringobligatorio

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • prefixstringobligatorio

      The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.

      pattern ^ccsio_[A-Za-z0-9_-]{8}$

    • created_bystringobligatorio

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • created_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

    • expires_atstring (date-time) or nullobligatorio

      RFC 3339, second precision, UTC; null when the key has no expiry.

    • statestringobligatorio

      The key state; revoked is terminal.

      Valores permitidos: "active""revoked"

    • revoked_atstring (date-time) or nullobligatorio

      RFC 3339, second precision, UTC; null while active.

    • kindstringobligatorio

      The persisted credential type; existing service-account keys retain service_account.

      Valores permitidos: "personal""service_account"

    • ownerobjectopcional

      • display_namestringobligatorio

        Readable owner name from the identity profile.

      • emailstringopcional

        Owner email when known; presentation only, never an authorization identifier.

      • kindstringobligatorio

        Valores permitidos: "human""service_account"

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Issue a new API key for the organization

Credencial

API key

Permiso

api-keys.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/api-keys" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "org_id": "acme",
  "name": "billing-app production",
  "principal_ref": "svc/01K7YP2C9W4X5E8H3J6M0N1Q2R",
  "expires_at": "2027-01-31T00:00:00Z"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The issued service-account key view, including its raw value exactly once.

  Esquema

  IssuedAPIKey

  • key_idstringobligatorio

    The platform-minted key id (uppercase ULID).

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • org_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • namestringobligatorio

    1 to 128 characters

  • principal_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • prefixstringobligatorio

    The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.

    pattern ^ccsio_[A-Za-z0-9_-]{8}$

  • created_bystringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • expires_atstring (date-time) or nullobligatorio

    RFC 3339, second precision, UTC; null when the key has no expiry.

  • statestringobligatorio

    A freshly issued key is always active.

    Valores permitidos: "active"

  • revoked_atnull or nullobligatorio

    A freshly issued key is never revoked; renders null.

  • rawstringobligatorio

    The raw key value, returned exactly once on successful issuance (service-account or personal): ccsio_ followed by 32 alphanumeric characters. Never returned by list, read or revoke operations, or included in errors or logs. Keys issued before this form (ccsio_ plus 43 base64url characters) remain valid credentials but are never minted again.

    pattern ^ccsio_[A-Za-z0-9]{32}$

  • kindstringobligatorio

    The persisted credential type; existing service-account keys retain service_account.

    Valores permitidos: "personal""service_account"

  • ownerobjectopcional

    • display_namestringobligatorio

      Readable owner name from the identity profile.

    • emailstringopcional

      Owner email when known; presentation only, never an authorization identifier.

    • kindstringobligatorio

      Valores permitidos: "human""service_account"

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

{
  "key_id": "01K7YQ4D8M2P6S9V3X5Z7B1C4F",
  "kind": "service_account",
  "owner": {
    "display_name": "billing-app",
    "kind": "service_account"
  },
  "org_id": "acme",
  "name": "billing-app production",
  "principal_ref": "svc/01K7YP2C9W4X5E8H3J6M0N1Q2R",
  "prefix": "ccsio_ExampleK",
  "created_by": "user/onboard/01K7YN1B3C5D7F9H2K4M6P8R0T",
  "created_at": "2026-10-14T09:30:00Z",
  "expires_at": "2027-01-31T00:00:00Z",
  "state": "active",
  "revoked_at": null,
  "raw": "ccsio_ExampleKeyShownOnceAtCreation000"
}

Read one API key

Credencial

API key

Permiso

Cualquiera deapi-keys.readsupport-access.read

curl "https://console.latam.ccsio.ai/identity/v1/api-keys/{id}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The key view (without raw).

  Esquema

  APIKey

  • key_idstringobligatorio

    The platform-minted key id (uppercase ULID).

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • org_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • namestringobligatorio

    1 to 128 characters

  • principal_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • prefixstringobligatorio

    The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.

    pattern ^ccsio_[A-Za-z0-9_-]{8}$

  • created_bystringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • expires_atstring (date-time) or nullobligatorio

    RFC 3339, second precision, UTC; null when the key has no expiry.

  • statestringobligatorio

    The key state; revoked is terminal.

    Valores permitidos: "active""revoked"

  • revoked_atstring (date-time) or nullobligatorio

    RFC 3339, second precision, UTC; null while active.

  • kindstringobligatorio

    The persisted credential type; existing service-account keys retain service_account.

    Valores permitidos: "personal""service_account"

  • ownerobjectopcional

    • display_namestringobligatorio

      Readable owner name from the identity profile.

    • emailstringopcional

      Owner email when known; presentation only, never an authorization identifier.

    • kindstringobligatorio

      Valores permitidos: "human""service_account"

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Delete a revoked API key

Credencial

API key

Permiso

api-keys.manage

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/api-keys/{id}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 204

  The key is deleted. No body.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

Revoke an API key (terminal)

Credencial

API key

Permiso

api-keys.manage

curl -X POST "https://console.latam.ccsio.ai/identity/v1/api-keys/{id}/revoke" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The key view, state revoked, with revoked_at.

  Esquema

  APIKey

  • key_idstringobligatorio

    The platform-minted key id (uppercase ULID).

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • org_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • namestringobligatorio

    1 to 128 characters

  • principal_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • prefixstringobligatorio

    The display prefix (ccsio_ plus the first 8 entropy characters) — never the raw value, never a digest.

    pattern ^ccsio_[A-Za-z0-9_-]{8}$

  • created_bystringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • expires_atstring (date-time) or nullobligatorio

    RFC 3339, second precision, UTC; null when the key has no expiry.

  • statestringobligatorio

    The key state; revoked is terminal.

    Valores permitidos: "active""revoked"

  • revoked_atstring (date-time) or nullobligatorio

    RFC 3339, second precision, UTC; null while active.

  • kindstringobligatorio

    The persisted credential type; existing service-account keys retain service_account.

    Valores permitidos: "personal""service_account"

  • ownerobjectopcional

    • display_namestringobligatorio

      Readable owner name from the identity profile.

    • emailstringopcional

      Owner email when known; presentation only, never an authorization identifier.

    • kindstringobligatorio

      Valores permitidos: "human""service_account"

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

List service accounts available for API-key issuance

Credencial

API key

Permiso

api-keys.manage

curl "https://console.latam.ccsio.ai/identity/v1/api-key-principals?org=<org>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The eligible service-account page.

  Esquema

  ListAPIKeyPrincipalsResponse

  • principalsarray of APIKeyPrincipalobligatorio

    • principal_refstringobligatorio

      Stable service-account reference sent as principal_ref when issuing a key.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • display_namestringobligatorio
    • kindstringobligatorio

      always "service_account"

  • next_cursorstring or nullobligatorio

    Opaque continuation cursor; null at the end of the result set.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.