The descriptions of the operations and fields are the contract’s own, in English.
/identity/v1/organizations/{org}/limitsList every configured limits row of an organization
- Credential
- API key
- Permission
- Any of
organization.updatesupport-access.read
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request.
Read more
Returns the organization's baseline row (if configured) and every team, model and deployment override: the same set the signed context carries to the Router. Failures: 400 name-invalid; 404 organization-not-found (an unknown organization, never an empty list); 500 server faults.
curl "https://console.us.ccsio.ai/identity/v1/organizations/{org}/limits" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Responses
- 200
Every configured limits row of the organization.
Schema
ListTenantLimitsResponselimitsarray of TenantLimitsrequiredorganization_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
scopestringrequiredAllowed values:
"organization""team""model""deployment"team_idstring or nullrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
model_refstring or nullrequiredpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstring or nullrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nullrequiredHow many requests may run at once; null means unlimited.
0 to 2147483647
requests_per_minuteinteger or nullrequiredHow many requests may start per minute; null means unlimited.
0 to 2147483647
created_atstring (date-time)requiredRFC 3339, second precision, UTC.
updated_atstring (date-time)requiredRFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
/identity/v1/organizations/{org}/limitsWrite one limits row of an organization
- Credential
- API key
- Permission
organization.update- Request body
- Body up to 1 MiB
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request.
Read more
Writes one row: the organization-wide baseline (scope organization) or an override for a team, a model or a deployment. scope is required, and exactly the one key it names is required with a scope other than organization (team, model_ref or deployment_id) and none with scope organization. The keys are stored as given: none is checked against the organization's teams, models or deployments. max_concurrent_requests and requests_per_minute are each independently optional: absent or null means unlimited, never a magic number; present, each must be a whole number from 0 up to 2147483647 (0 is a deliberate limit that blocks everything; a negative value is 400 tenant-limits-invalid, and a larger one is a server fault). A write fully replaces the row's limit values, never merges them, and repeating a request writes the same row. Failures: 400 invalid-request (scope missing, or an unknown member or a value that is not a whole number); 400 tenant-limits-invalid (a scope outside the four, a scope and key that do not go together, a key outside its pattern, a negative value); 400 name-invalid (the path organization outside the C7 pattern); 404 organization-not-found; 500 server faults.
curl -X PUT "https://console.us.ccsio.ai/identity/v1/organizations/{org}/limits" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"scope": "organization"
}'Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Request body application/json
scopestringrequiredAllowed values:
"organization""team""model""deployment"teamstringoptionalRequired with scope team, and not allowed with any other scope.
pattern ^[a-z][a-z0-9._-]{0,63}$
model_refstringoptionalRequired with scope model, and not allowed with any other scope.
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstringoptionalRequired with scope deployment, and not allowed with any other scope.
pattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nulloptionalHow many requests may run at once. A non-negative whole number up to 2147483647 (a larger one is a server fault, 500); absent or null means unlimited, never a magic number, and 0 is a deliberate limit that blocks everything.
0 to 2147483647
requests_per_minuteinteger or nulloptionalHow many requests may start per minute. A non-negative whole number up to 2147483647 (a larger one is a server fault, 500); absent or null means unlimited, never a magic number, and 0 is a deliberate limit that blocks everything.
0 to 2147483647
Responses
- 200
The stored limits row.
Schema
TenantLimitsorganization_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
scopestringrequiredAllowed values:
"organization""team""model""deployment"team_idstring or nullrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
model_refstring or nullrequiredpattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
deployment_idstring or nullrequiredpattern ^[a-z][a-z0-9._-]{0,63}$
max_concurrent_requestsinteger or nullrequiredHow many requests may run at once; null means unlimited.
0 to 2147483647
requests_per_minuteinteger or nullrequiredHow many requests may start per minute; null means unlimited.
0 to 2147483647
created_atstring (date-time)requiredRFC 3339, second precision, UTC.
updated_atstring (date-time)requiredRFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
/identity/v1/organizations/{org}/limitsRemove one limits row of an organization
- Credential
- API key
- Permission
organization.update
Needs organization.update in the organization (the Root and Organization Admin roles hold it). The limits are the configured numbers: the Inference Router receives them in the signed context of each inference request. scope is a required query parameter (400 invalid-request when it is missing).
Read more
The key of the row goes with a scope other than organization: team, model_ref or deployment_id, query-carried because a C0 ref may contain '/' and ':', which path segments mangle. Send only the key the scope names: with scope organization every key is ignored, and when several keys are sent deployment_id wins over model_ref, which wins over team. The row is physically deleted and reverts to unconfigured, which is unlimited. A scope or key that matches no row (a missing key included) finds none: 404 tenant-limits-not-found. Failures: 400 invalid-request (scope missing); 400 name-invalid (the path organization outside the C7 pattern); 404 tenant-limits-not-found; 500 server faults.
curl -X DELETE "https://console.us.ccsio.ai/identity/v1/organizations/{org}/limits?scope=<scope>" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
scoperequired | query | string The scope of the row: organization, team, model or deployment. |
teamoptional | query | string The team of the row, with scope team. |
model_refoptional | query | string The model of the row, with scope model. |
deployment_idoptional | query | string The deployment of the row, with scope deployment. |
Responses
- 200
The removal acknowledgment.
Schema
StatusRemovedstatusstringrequiredalways "removed"
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
Generated from the platform contracts at commit 5f833620.