Las descripciones de las operaciones y los campos son las del contrato, en inglés.
/identity/v1/organizations/{org}/limitsList every configured limits row of an organization
- Credencial
- API key
- Permiso
- Cualquiera de
organization.updatesupport-access.read
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request.
Leer más
Returns the organization's baseline row (if configured) and every team, model and deployment override: the same set the signed context carries to the Router. Failures: 400 name-invalid; 404 organization-not-found (an unknown organization, never an empty list); 500 server faults.
curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/limits" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parámetros
| Nombre | En | Descripción |
|---|---|---|
X-Request-IDopcional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgobligatorio | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Respuestas
- 200
Every configured limits row of the organization.
Esquema
ListTenantLimitsResponselimitsarray of TenantLimitsobligatorioorganization_idstringobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
scopestringobligatorioValores permitidos:
"organization""team""model""deployment"team_idstring or nullobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
model_refstring or nullobligatoriopattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstring or nullobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nullobligatorioHow many requests may run at once; null means unlimited.
0 to 2147483647
requests_per_minuteinteger or nullobligatorioHow many requests may start per minute; null means unlimited.
0 to 2147483647
created_atstring (date-time)obligatorioRFC 3339, second precision, UTC.
updated_atstring (date-time)obligatorioRFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Leer más
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
/identity/v1/organizations/{org}/limitsWrite one limits row of an organization
- Credencial
- API key
- Permiso
organization.update- Cuerpo de la solicitud
- Cuerpo de hasta 1 MiB
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request.
Leer más
Writes one row: the organization-wide baseline (scope organization) or an override for a team, a model or a deployment. scope is required, and exactly the one key it names is required with a scope other than organization (team, model_ref or deployment_id) and none with scope organization. The keys are stored as given: none is checked against the organization's teams, models or deployments. max_concurrent_requests and requests_per_minute are each independently optional: absent or null means unlimited, never a magic number; present, each must be a whole number from 0 up to 2147483647 (0 is a deliberate limit that blocks everything; a negative value is 400 tenant-limits-invalid, and a larger one is a server fault). A write fully replaces the row's limit values, never merges them, and repeating a request writes the same row. Failures: 400 invalid-request (scope missing, or an unknown member or a value that is not a whole number); 400 tenant-limits-invalid (a scope outside the four, a scope and key that do not go together, a key outside its pattern, a negative value); 400 name-invalid (the path organization outside the C7 pattern); 404 organization-not-found; 500 server faults.
curl -X PUT "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/limits" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"scope": "organization"
}'Parámetros
| Nombre | En | Descripción |
|---|---|---|
X-Request-IDopcional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgobligatorio | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Cuerpo de la solicitud application/json
scopestringobligatorioValores permitidos:
"organization""team""model""deployment"teamstringopcionalRequired with scope team, and not allowed with any other scope.
pattern ^[a-z][a-z0-9._-]{0,63}$
model_refstringopcionalRequired with scope model, and not allowed with any other scope.
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstringopcionalRequired with scope deployment, and not allowed with any other scope.
pattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nullopcionalHow many requests may run at once. A non-negative whole number up to 2147483647 (a larger one is a server fault, 500); absent or null means unlimited, never a magic number, and 0 is a deliberate limit that blocks everything.
0 to 2147483647
requests_per_minuteinteger or nullopcionalHow many requests may start per minute. A non-negative whole number up to 2147483647 (a larger one is a server fault, 500); absent or null means unlimited, never a magic number, and 0 is a deliberate limit that blocks everything.
0 to 2147483647
Respuestas
- 200
The stored limits row.
Esquema
TenantLimitsorganization_idstringobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
scopestringobligatorioValores permitidos:
"organization""team""model""deployment"team_idstring or nullobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
model_refstring or nullobligatoriopattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstring or nullobligatoriopattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nullobligatorioHow many requests may run at once; null means unlimited.
0 to 2147483647
requests_per_minuteinteger or nullobligatorioHow many requests may start per minute; null means unlimited.
0 to 2147483647
created_atstring (date-time)obligatorioRFC 3339, second precision, UTC.
updated_atstring (date-time)obligatorioRFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Leer más
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
/identity/v1/organizations/{org}/limitsRemove one limits row of an organization
- Credencial
- API key
- Permiso
organization.update
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request. scope is a required query parameter (400 invalid-request when it is missing).
Leer más
The key of the row goes with a scope other than organization: team, model_ref or deployment_id, query-carried because a C0 ref may contain '/' and ':', which path segments mangle. Send only the key the scope names: with scope organization every key is ignored, and when several keys are sent deployment_id wins over model_ref, which wins over team. The row is physically deleted and reverts to unconfigured, which is unlimited. A scope or key that matches no row (a missing key included) finds none: 404 tenant-limits-not-found. Failures: 400 invalid-request (scope missing); 400 name-invalid (the path organization outside the C7 pattern); 404 tenant-limits-not-found; 500 server faults.
curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/limits?scope=<scope>" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parámetros
| Nombre | En | Descripción |
|---|---|---|
X-Request-IDopcional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgobligatorio | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
scopeobligatorio | query | string The scope of the row: organization, team, model or deployment. |
teamopcional | query | string The team of the row, with scope team. |
model_refopcional | query | string The model of the row, with scope model. |
deployment_idopcional | query | string The deployment of the row, with scope deployment. |
Respuestas
- 200
The removal acknowledgment.
Esquema
StatusRemovedstatusstringobligatorioalways "removed"
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Leer más
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Leer más
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Leer más
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
Generado a partir de los contratos de la plataforma en el commit 5f833620.