Support access

List the support sessions of an organization

Credencial

API key

Permiso

Cualquiera deaudit.readsupport-sessions.manage

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/support-sessions" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organization's support sessions.

  Esquema

  SupportSessionList

  • sessionsarray of SupportSessionobligatorio

    Newest first by started_at, then session_id.

    • session_idstringobligatorio

      pattern ^[0-9A-HJKMNP-TV-Z]{26}$

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • operatorobjectobligatorio

      The operator who holds the session, as the plane recorded the person when the session started (their name and email are frozen on the session, so the record survives a later rename or a change of identity provider). display_name and email are null only when the staff directory gave none; every caller who may list the sessions (audit.read in the organization, support-sessions.manage in the plane) reads them, because they are the record of who accessed the organization.

      • user_refstringobligatorio

        The operator's user_ref in this plane (user/staff/...), the value GET /identity/v1/context reports as identity.ref for that person's session.

        pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

      • display_namestring or nullobligatorio

        The operator's display name; null when the staff directory gave none.

        at most 128 characters

      • emailstring or nullobligatorio

        The operator's email address; null when the staff directory gave none.

        at most 254 characters

    • reasonstringobligatorio

      Why the operator opened the session, as they wrote it: one line, shown to the organization.

      10 to 128 characters

    • statusstringobligatorio

      Valores permitidos: "active""ended"

    • started_atstring (date-time)obligatorio

      When the session was opened. RFC 3339, second precision, UTC. Set by the database clock.

    • expires_atstring (date-time)obligatorio

      When the access stops. started_at plus the duration; never later than four hours after started_at. A session is never extended: a new one needs a new reason.

    • remaining_secondsintegerobligatorio

      Seconds of access left, computed by the database clock; 0 once the session ended. A client counts down from this value and not from its own clock.

      at least 0

    • ended_atstring (date-time) or nullobligatorio

      When the access stopped (expires_at for an expiry); null while the session is active.

    • end_reasonstring or nullobligatorio

      Why it ended. operator: the operator ended it; platform: another operator did; organization: an administrator of the organization did; access_disabled: the organization turned support access off; operator_signed_out: the operator signed out of the backoffice (best effort); expired: the time box ran out; start_failed: the session could not be recorded when it started and never gave access. null while active.

      Valores permitidos: "operator""platform""organization""access_disabled""operator_signed_out""expired""start_failed"null

    • ended_bystring or nullobligatorio

      The user_ref of the person who ended it; null while active, and for an expiry or a session that never started.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

End a support session

Credencial

API key

Permiso

Cualquiera deorganization.updatesupport-sessions.manage

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/support-sessions/{id}/end" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The ended session.

  Esquema

  SupportSession

  • session_idstringobligatorio

    pattern ^[0-9A-HJKMNP-TV-Z]{26}$

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • operatorobjectobligatorio

    The operator who holds the session, as the plane recorded the person when the session started (their name and email are frozen on the session, so the record survives a later rename or a change of identity provider). display_name and email are null only when the staff directory gave none; every caller who may list the sessions (audit.read in the organization, support-sessions.manage in the plane) reads them, because they are the record of who accessed the organization.

    • user_refstringobligatorio

      The operator's user_ref in this plane (user/staff/...), the value GET /identity/v1/context reports as identity.ref for that person's session.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • display_namestring or nullobligatorio

      The operator's display name; null when the staff directory gave none.

      at most 128 characters

    • emailstring or nullobligatorio

      The operator's email address; null when the staff directory gave none.

      at most 254 characters

  • reasonstringobligatorio

    Why the operator opened the session, as they wrote it: one line, shown to the organization.

    10 to 128 characters

  • statusstringobligatorio

    Valores permitidos: "active""ended"

  • started_atstring (date-time)obligatorio

    When the session was opened. RFC 3339, second precision, UTC. Set by the database clock.

  • expires_atstring (date-time)obligatorio

    When the access stops. started_at plus the duration; never later than four hours after started_at. A session is never extended: a new one needs a new reason.

  • remaining_secondsintegerobligatorio

    Seconds of access left, computed by the database clock; 0 once the session ended. A client counts down from this value and not from its own clock.

    at least 0

  • ended_atstring (date-time) or nullobligatorio

    When the access stopped (expires_at for an expiry); null while the session is active.

  • end_reasonstring or nullobligatorio

    Why it ended. operator: the operator ended it; platform: another operator did; organization: an administrator of the organization did; access_disabled: the organization turned support access off; operator_signed_out: the operator signed out of the backoffice (best effort); expired: the time box ran out; start_failed: the session could not be recorded when it started and never gave access. null while active.

    Valores permitidos: "operator""platform""organization""access_disabled""operator_signed_out""expired""start_failed"null

  • ended_bystring or nullobligatorio

    The user_ref of the person who ended it; null while active, and for an expiry or a session that never started.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Read whether support may open a session

Credencial

API key

Permiso

Cualquiera deorganization.updatesupport-sessions.manage

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/support-access" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organization's support access setting.

  Esquema

  SupportAccessSetting

  • modestringobligatorio

    Valores permitidos: "allowed""denied"

  • updated_atstring (date-time) or nullobligatorio

    When the setting was last changed; null if it never was.

  • updated_bystring or nullobligatorio

    The user_ref of who changed it last; null if it never was.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Allow or deny support sessions

Credencial

API key

Permiso

organization.update

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X PUT "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/support-access" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "mode": "allowed"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The setting after the change.

  Esquema

  SupportAccessSetting

  • modestringobligatorio

    Valores permitidos: "allowed""denied"

  • updated_atstring (date-time) or nullobligatorio

    When the setting was last changed; null if it never was.

  • updated_bystring or nullobligatorio

    The user_ref of who changed it last; null if it never was.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)