Entitlements API

Base: /org/subscribers/{subscriber_id}/entitlements

Auth: a member API key whose role has check (X-API-Key): every role does, and runtime has only that. POST check and GET entitlements are the same resolution, different shape. How the value is decided: Resolution order. How to use them: Check access.

Check feature

POST /org/subscribers/{subscriber_id}/entitlements/check

{
  "feature": "sso"
}

Field	Required	Rules
feature	yes	Feature key string

200 — always when subscriber exists (even if not entitled)

Flag

{
  "feature": "sso",
  "kind": "flag",
  "allowed": true,
  "source": "plan"
}

Limit

{
  "feature": "seats",
  "kind": "limit",
  "limit": 10,
  "source": "plan"
}

Unlimited:

{
  "feature": "seats",
  "kind": "limit",
  "limit": null,
  "source": "override"
}

Not entitled (no grant):

{
  "feature": "seats",
  "kind": "limit",
  "limit": 0,
  "source": "none"
}

Config

{
  "feature": "support_tier",
  "kind": "config",
  "value_type": "enum",
  "value": "priority",
  "source": "plan"
}

Not set (no override, not on the plan): there's no default.

{
  "feature": "brand_color",
  "kind": "config",
  "value_type": "string",
  "value": null,
  "source": "none"
}

Field	Meaning
kind	flag, limit, or config (from catalog)
allowed	Flag only
limit	Limit only: integer ≥ 0, or null = unlimited
value_type	Config only: string | number | boolean | enum | json
value	Config only: a value of value_type, or null when nothing sets it
source	override | plan | none

Note

For flags: deny via override → allowed: false, source: override.
Deny with no override/plan → allowed: false, source: none.
For limits: missing grant → limit: 0, source: none. Explicit plan limit: 0 → source: plan.
For configs: missing grant → value: null, source: none. A falsy value the plan sets (false, 0, "") → source: plan.

404 — subscriber not found

422 — missing/invalid body, or feature is not a key in your catalog

429 — GET entitlements and POST check share 100 requests per second per organization.

409 CONFLICT — Free plan only: your organization's monthly eval allotment ran out and the 7-day grace period has passed. See Eval usage.

Each 2xx response counts as one eval and may carry X-E10s-Eval-* headers. See Eval usage.

List entitlements

GET /org/subscribers/{subscriber_id}/entitlements

Same check label as POST check.

By default, returns only features that are entitled:

• flag with allowed: true
• limit with limit === null or limit > 0
• config with value !== null (false, 0, and "" count)

Pass ?all=true to include every catalog feature with full effective values.

200 (default)

{
  "features": [
    {
      "feature": "sso",
      "kind": "flag",
      "allowed": true,
      "source": "plan"
    },
    {
      "feature": "seats",
      "kind": "limit",
      "limit": 10,
      "source": "plan"
    },
    {
      "feature": "support_tier",
      "kind": "config",
      "value_type": "enum",
      "value": "priority",
      "source": "plan"
    }
  ]
}

404 — subscriber not found

429 — same 100/sec per organization bucket as POST check.

409 — same monthly eval allotment rule as POST check. ?all=true is still one eval.