Reservations

Reserve budget

Credential

API key

Permission

usage.manage

Request body

Body up to 1 MiB

curl -X POST "https://console.us.ccsio.ai/metering/v1/reservations" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "reservation_id": "string",
  "tenant_id": "string",
  "plane_id": "string",
  "root_run_id": "string",
  "amount": "string",
  "ttl_seconds": 0
}'

Parameters

Request body application/json

Responses

• 200

  The reservation, in the reserved state.

  Schema

  ReservationView

  • reservation_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • statestringrequired

    The reservation state machine state.

    Allowed values: "reserved""committed""released""expired"

  • amountstringrequired

    The money canonical string: <integer minor units> <3-letter ISO 4217 currency> (e.g. 10 USD). A malformed string is 400 invalid-request (decode); a parsed-but-non-positive amount is 400 reservation-invalid (use case). The integer minor-units field is int64-bounded: a value outside the int64 range is 400 invalid-request at decode (the pattern is syntactic; the decode layer enforces the range).

    pattern ^-?[0-9]+ [A-Z]{3}$

  • reserved_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • expires_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • bindingobjectrequired

    The budget binding: the scope identifiers, allocations (1..3 unique slugs), unit, and ceiling (C8).

    • tenant_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • plane_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • root_run_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • allocation_idsarray of stringrequired

      at least 1 items · at most 3 items

    • unitstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • ceilingintegerrequired

      1 to 9007199254740991

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Read more

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Read more

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Read more

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Commit a reservation in full

Credential

API key

Permission

usage.manage

Request body

Body up to 1 MiB

curl -X POST "https://console.us.ccsio.ai/metering/v1/reservations/{id}/commit" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Parameters

Request body application/json

Responses

• 200

  The reservation, in the committed state.

  Schema

  ReservationView

  • reservation_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • statestringrequired

    The reservation state machine state.

    Allowed values: "reserved""committed""released""expired"

  • amountstringrequired

    The money canonical string: <integer minor units> <3-letter ISO 4217 currency> (e.g. 10 USD). A malformed string is 400 invalid-request (decode); a parsed-but-non-positive amount is 400 reservation-invalid (use case). The integer minor-units field is int64-bounded: a value outside the int64 range is 400 invalid-request at decode (the pattern is syntactic; the decode layer enforces the range).

    pattern ^-?[0-9]+ [A-Z]{3}$

  • reserved_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • expires_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • bindingobjectrequired

    The budget binding: the scope identifiers, allocations (1..3 unique slugs), unit, and ceiling (C8).

    • tenant_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • plane_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • root_run_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • allocation_idsarray of stringrequired

      at least 1 items · at most 3 items

    • unitstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • ceilingintegerrequired

      1 to 9007199254740991

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Read more

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Read more

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Read more

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Release a reservation

Credential

API key

Permission

usage.manage

curl -X POST "https://console.us.ccsio.ai/metering/v1/reservations/{id}/release" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Responses

• 200

  The reservation, in the released state.

  Schema

  ReservationView

  • reservation_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • statestringrequired

    The reservation state machine state.

    Allowed values: "reserved""committed""released""expired"

  • amountstringrequired

    The money canonical string: <integer minor units> <3-letter ISO 4217 currency> (e.g. 10 USD). A malformed string is 400 invalid-request (decode); a parsed-but-non-positive amount is 400 reservation-invalid (use case). The integer minor-units field is int64-bounded: a value outside the int64 range is 400 invalid-request at decode (the pattern is syntactic; the decode layer enforces the range).

    pattern ^-?[0-9]+ [A-Z]{3}$

  • reserved_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • expires_atstringrequired

    pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • bindingobjectrequired

    The budget binding: the scope identifiers, allocations (1..3 unique slugs), unit, and ceiling (C8).

    • tenant_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • plane_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • root_run_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • allocation_idsarray of stringrequired

      at least 1 items · at most 3 items

    • unitstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • ceilingintegerrequired

      1 to 9007199254740991

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Read more

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Read more

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Read more

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.