API overview

The e10s API is JSON over HTTPS. Every vendor resource lives under your organization.

Base path

https://api.e10s.io/org/…

The member key is the organization. The path does not name it.

Resource map

Resource	Path prefix	Purpose
Features	…/features	Catalog keys (flag | limit | config)
Plans	…/plans	Catalog + custom bundles (grants)
Subscribers	…/subscribers	Your customers
Subscriptions	…/subscribers/{subscriber_id}/subscriptions	Plan assignment
Overrides	…/subscribers/{subscriber_id}/overrides	Per-feature exceptions
Entitlements	…/subscribers/{subscriber_id}/entitlements	Check + list effective access
Webhook	…/webhook	Your outbound webhook URL and secret
Usage	…/usage/current	Your organization's own monthly eval count
Audit log	…/audit-events	Who changed what in your organization

Organizations, members, service accounts, API keys, invites, and the webhook URL are managed at e10s.io. See Console. Outbound events: Webhooks. Monthly eval metering: Eval usage. Who changed what: Audit log.

Conventions

• JSON request and response bodies
• You address features and plans by key, subscribers by the id you chose
• Timestamps in ISO-8601 UTC
• Snake_case field names
• Shared error shape — see Errors
• Paginated lists — see Lists

Auth summary

Operations	Credential	Header	Label	Lowest role
POST check, GET entitlements	Service account member API key	X-API-Key	check	runtime (new service accounts)
Features, plans	Same	X-API-Key	catalog:read / catalog:write	viewer / developer
Subscribers, subscriptions, overrides	Same	X-API-Key	subscribers:read / subscribers:write	viewer / developer
Webhook URL	Same, or the console	X-API-Key	webhooks:read / webhooks:write	viewer / developer
Eval usage	Same	X-API-Key	org:read	viewer
Audit log	Same, or the console	X-API-Key	org:audit:read	admin

Incoming webhook POSTs use HMAC, not X-API-Key. Details: Authentication, Webhooks.