Models

The descriptions of the operations and fields are the contract’s own, in English.

GET/models/v1/families

List model families

Credential: API key
Permission: models.read

Lists all model families. Returns null when the catalog is empty.

curl

curl "https://console.us.ccsio.ai/models/v1/families" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

Responses

200
Success.
Schema
ListFamiliesResponse
DisplayNamestringrequired
Capabilitiesarray of string or nullrequired
Allowed values: "chat-completions""embeddings""responses""audio-speech""audio-transcriptions""image-generations""decisions"
CreatedAtstring (date-time)required
RFC3339, PostgreSQL timestamptz precision (microseconds); the offset is process-local — canonical UTC-Z is a deferred runtime gap (Amendment E).
IDstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

GET/models/v1/families/{id}

List the model catalog

Credential: API key
Permission: models.read

Lists every regional model with its family's display name and a summary of the caller's own organization's deployments of it. The organization is the verified principal's tenant, never a request field: deployments of any other organization are never listed.

The platform organization's deployments are shared with every organization that holds model access to the model, but they are not the caller's own and are never listed here, so an entry's deployments array does not say whether the model is served to the caller: GET /v1/models lists what the caller can call. For a human platform operator (a human whose user holds the active platform role ccsio_admin; models.read is part of their operator set) the tenant is the organization they selected with X-Organization-Id, any existing organization, so the console can read another organization's catalog view. A deployment summary carries what a catalog browser needs (lifecycle status, provider class, effective upstream protocol, upstream model, serving capabilities, residency and data region) and never the endpoint, the credential reference or the key identity. A model the organization has not deployed itself lists an empty deployments array. A model whose serving pool for the caller holds an active deployment served from a third-party provider connection carries the optional hosting member (kind third_party, the connection's display name and the processing location it declares), the disclosure the console shows before a person uses the model; it is omitted for every other model. Models are sorted by id and deployments by id; the response never renders null. A model an organization added to its own provider connection (`byo:<org_id>:<name>`) is listed only in the list of the organization that owns it: no other organization's list carries it.

curl

curl "https://console.us.ccsio.ai/models/v1/models" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

Responses

200
Success.
Schema
ListModelsResponse
modelsarray of ModelCatalogEntryrequired
idstringrequired
The model ref a request names in its model field.
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
family_idstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
family_namestringrequired
The family's display name.
residencystringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
data_regionstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
capabilitiesarray of stringrequired
What the regional model declares it serves. May be empty; a deployment's own capabilities say what it serves.
Allowed values: "chat-completions""embeddings""responses""audio-speech""audio-transcriptions""image-generations""decisions"
created_atstring (date-time)required
RFC3339, PostgreSQL timestamptz precision.
deploymentsarray of ModelDeploymentSummaryrequired
The caller's organization's OWN deployments of this model, sorted by id; empty when it owns none. Deployments of another organization that serve the caller (the platform organization's, shared with every organization that holds model access to the model) are never listed here: whether the model can be called is answered by GET /v1/models.
hostingobjectoptional
Who processes a request to this model when it is not the platform itself: present only when the model's serving pool for the caller (the caller's own deployments when it has an active one, else the platform organization's in the caller's placement) holds an active deployment served from a third-party provider connection (provider class EXTERNAL_MANAGED with a stored key), omitted otherwise, so the entry of an ordinary model is exactly what it was before this member existed. It carries only the connection's public disclosure fields, never its base URL, the state of its key or any credential. When the pool holds several such deployments the entry names the connection of the deployment with the smallest id, the one selection prefers.
kindstringrequired
The only kind today: the model is served by a third party's API, under the platform's own agreement with it.
Allowed values: "third_party"
provider_namestringrequired
The connection's display name, as the operator who connected it typed it.
1 to 80 characters
processing_locationstringoptional
Where the provider processes the data, as declared by the operator who connected it (free text); omitted when the connection declares none.
1 to 120 characters
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Example response

{
  "models": [
    {
      "id": "embed-1",
      "family_id": "embed",
      "family_name": "Embeddings",
      "residency": "eu",
      "data_region": "eu-central-1",
      "capabilities": [
        "embeddings"
      ],
      "created_at": "2026-09-01T08:00:00Z",
      "deployments": [],
      "hosting": {
        "kind": "third_party",
        "provider_name": "Example AI",
        "processing_location": "European Union"
      }
    },
    {
      "id": "glm-5.3",
      "family_id": "glm",
      "family_name": "GLM",
      "residency": "eu",
      "data_region": "eu-central-1",
      "capabilities": [
        "chat-completions",
        "responses"
      ],
      "created_at": "2026-09-01T08:00:00Z",
      "deployments": [
        {
          "id": "dep-glm-eu-1",
          "status": "ACTIVE",
          "provider_class": "CCSIO_INFERENCE",
          "protocol": "openai-compat",
          "upstream_model": "glm-5.3",
          "capabilities": [
            "chat-completions",
            "responses"
          ],
          "residency": "eu",
          "data_region": "eu-central-1",
          "created_at": "2026-09-01T09:00:00Z"
        }
      ]
    }
  ]
}

GET/models/v1/models/{id}

Get a regional model

Credential: API key
Permission: models.read

Retrieves a regional model by ID. A model that another organization added to its own provider connection (`byo:<org_id>:<name>`) is not found, as if it did not exist.

curl

curl "https://console.us.ccsio.ai/models/v1/models/{id}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`id` required	path	string Regional model identifier (C0 ref).

Responses

200
Success.
Schema
RegionalModel
Familystringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
Residencystringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
DataRegionstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
Capabilitiesarray of string or nullrequired
Allowed values: "chat-completions""embeddings""responses""audio-speech""audio-transcriptions""image-generations""decisions"
CreatedAtstring (date-time)required
RFC3339, PostgreSQL timestamptz precision (microseconds); the offset is process-local — canonical UTC-Z is a deferred runtime gap (Amendment E).
IDstringrequired
pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Example response

{
  "ID": "glm-5.3",
  "Family": "glm",
  "Residency": "eu",
  "DataRegion": "eu-central-1",
  "Capabilities": [
    "chat-completions",
    "responses"
  ],
  "CreatedAt": "2026-09-01T08:00:00Z"
}

Generated from the platform contracts at commit 5f833620.

List model families

Parameters

Responses

Get a model family

Parameters

Responses

List the model catalog

Parameters

Responses

Get a regional model

Parameters

Responses

Get your first API key