The descriptions of the operations and fields are the contract’s own, in English.
/identity/v1/organizations/{org}/rolesList the organization's roles and the permission catalog
- Credential
- API key
- Permission
- Any of
roles.readsupport-access.read
Requires roles.read held by an active membership of the organization at ANY level - organization or team: a Team Admin whose only binding is a team's can resolve custom role names to render its own roster. Every built-in organization role holds roles.read.
Read more
Returns the four built-in roles in rank order — root, organization_admin, team_admin, user; ccsio_admin is platform-only and never listed — followed by the organization's custom roles by name, and the catalog of permissions a custom role may carry. A custom role renders member_count, created_at and updated_at in addition.
curl "https://console.us.ccsio.ai/identity/v1/organizations/{org}/roles" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Responses
- 200
The roles and the permission catalog.
Schema
ListRolesResponserolesarray of RolerequiredThe four built-in roles in rank order (root, organization_admin, team_admin, user; ccsio_admin is platform-only and never listed), then the organization's custom roles by name.
idstringrequiredpattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$
kindstringrequiredAllowed values:
"builtin""custom"namestringrequired1 to 64 characters
descriptionstringrequiredat most 512 characters
levelsarray of stringrequiredWhere the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.
Allowed values:
"organization""team"at least 1 items
permissionsarray of PermissionrequiredIn the closed vocabulary's canonical order.
member_countintegeroptionalCustom roles only.
at least 0
created_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
updated_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
permission_catalogarray of PermissionCatalogEntryrequiredThe permissions a custom role may carry, in the closed vocabulary's canonical order.
idstringrequiredA permission a custom role may carry: every permission except organization.delete and members.transfer (root alone), users.manage (held by ccsio_admin alone) and the platform-scoped ones (34 strings, teams.read_own among them; the two AI-199 platform-scoped permissions, the two platform-operators permissions, registry.manage, platform-usage.read, the three that write the model catalog and manage deployments, models.manage, deployments.read and deployments.manage, and the two of the model groups, model-groups.read and model-groups.manage, are not among them; mcp.invoke, mcp.read, mcp.manage and model-providers.manage are). The acting principal must effectively hold every permission it puts into a role.
Allowed values:
"organization.read""organization.update""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""users.read""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""team-entitlements.manage""models.read""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"levelsarray of stringrequiredThe levels a role carrying this permission may be assigned at.
Allowed values:
"organization""team"at least 1 items
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
/identity/v1/organizations/{org}/rolesCreate a custom role
- Credential
- API key
- Permission
roles.manage- Request body
- Body up to 1 MiB
Requires roles.manage. Creates a per-organization custom role: a name (unique within the organization case-insensitively, never a built-in role's name), an optional description and a permission set chosen from the catalog (every permission except organization.delete and the platform-scoped ones).
Read more
The id is server-generated (role_<id>), path-safe and can never collide with a built-in id; it is used verbatim as the role value everywhere a role travels. Anti-escalation: the acting principal must effectively hold every permission it puts into the role at organization scope (403 role-escalation). Sensitive: audited.
curl -X POST "https://console.us.ccsio.ai/identity/v1/organizations/{org}/roles" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Usage analyst",
"description": "Reads usage and the member list of the whole organization.",
"permissions": [
"members.read",
"usage.read"
]
}'Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
Request body application/json
namestringrequiredTrimmed, 1 to 64 characters, no control characters; unique within the organization case-insensitively and never a built-in role's name (Root, Admin, Team Admin, User).
1 to 64 characters
descriptionstringoptionalOptional; trimmed.
at most 512 characters
permissionsarray of CustomRolePermissionrequiredDuplicates are collapsed. May be empty.
Allowed values:
"organization.read""organization.update""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""users.read""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""team-entitlements.manage""models.read""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"
Responses
- 201
The created custom role (member_count 0).
Schema
Roleidstringrequiredpattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$
kindstringrequiredAllowed values:
"builtin""custom"namestringrequired1 to 64 characters
descriptionstringrequiredat most 512 characters
levelsarray of stringrequiredWhere the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.
Allowed values:
"organization""team"at least 1 items
permissionsarray of PermissionrequiredIn the closed vocabulary's canonical order.
Allowed values:
"organization.create""organization.read""organization.update""organization.delete""organization.status""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""members.transfer""users.read""users.manage""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""entitlements.manage""team-entitlements.manage""issuers.read""issuers.manage""models.read""models.manage""models.register""model-registrars.manage""platform-operators.read""platform-operators.manage""registry.manage""platform-usage.read""support-sessions.start""support-sessions.manage""support-access.read""deployments.read""deployments.manage""model-groups.read""model-groups.manage""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"member_countintegeroptionalCustom roles only.
at least 0
created_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
updated_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
{
"id": "role_01k7yq4d8m2p6s9v3x5z7b1c4f",
"kind": "custom",
"name": "Usage analyst",
"description": "Reads usage and the member list of the whole organization.",
"levels": [
"organization",
"team"
],
"permissions": [
"members.read",
"usage.read"
],
"member_count": 0,
"created_at": "2026-10-14T09:45:00Z",
"updated_at": "2026-10-14T09:45:00Z"
}/identity/v1/organizations/{org}/roles/{role}Update a custom role
- Credential
- API key
- Permission
roles.manage- Request body
- Body up to 1 MiB
Requires roles.manage. Any of name, description and permissions (at least one); permissions replaces the whole set. A built-in role is immutable (403 role-builtin). Anti-escalation: the actor must hold every permission the role carries before the change and after it (403 role-escalation). The new permission set takes effect on the next request of every holder — no stale authority beyond an in-flight request. Sensitive: audited.
curl -X PATCH "https://console.us.ccsio.ai/identity/v1/organizations/{org}/roles/{role}" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
rolerequired | path | string A custom role id (role_<id>), as listed by GET /identity/v1/organizations/{org}/roles. A built-in role id is accepted by the route and refused with 403 role-builtin; any other value is 404 role-not-found. |
Request body application/json
namestringoptional1 to 64 characters
descriptionstringoptionalat most 512 characters
permissionsarray of CustomRolePermissionoptionalReplaces the whole permission set.
Allowed values:
"organization.read""organization.update""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""users.read""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""team-entitlements.manage""models.read""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"
Responses
- 200
The updated custom role.
Schema
Roleidstringrequiredpattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$
kindstringrequiredAllowed values:
"builtin""custom"namestringrequired1 to 64 characters
descriptionstringrequiredat most 512 characters
levelsarray of stringrequiredWhere the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.
Allowed values:
"organization""team"at least 1 items
permissionsarray of PermissionrequiredIn the closed vocabulary's canonical order.
Allowed values:
"organization.create""organization.read""organization.update""organization.delete""organization.status""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""members.transfer""users.read""users.manage""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""entitlements.manage""team-entitlements.manage""issuers.read""issuers.manage""models.read""models.manage""models.register""model-registrars.manage""platform-operators.read""platform-operators.manage""registry.manage""platform-usage.read""support-sessions.start""support-sessions.manage""support-access.read""deployments.read""deployments.manage""model-groups.read""model-groups.manage""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"member_countintegeroptionalCustom roles only.
at least 0
created_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
updated_atstring (date-time)optionalCustom roles only. RFC 3339, second precision, UTC.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
/identity/v1/organizations/{org}/roles/{role}Delete a custom role
- Credential
- API key
- Permission
roles.manage
Requires roles.manage. A custom role held by any non-removed membership (active or disabled) cannot be deleted: 409 role-in-use. A built-in role is 403 role-builtin. The actor must hold every permission the role carries (403 role-escalation). Sensitive: audited.
curl -X DELETE "https://console.us.ccsio.ai/identity/v1/organizations/{org}/roles/{role}" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
orgrequired | path | string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid. |
rolerequired | path | string A custom role id (role_<id>), as listed by GET /identity/v1/organizations/{org}/roles. A built-in role id is accepted by the route and refused with 403 role-builtin; any other value is 404 role-not-found. |
Responses
- 204
The role was deleted.
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 404
The requested resource or path was not found.
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 409
The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).
- 500
Platform failure, rendered without internal cause details.
- 503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)
Generated from the platform contracts at commit 5f833620.