Elaichi Entitlements API
The Entitlements API from Elaichi — 1 operation(s) for entitlements.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elaichi-ai:elaichi-ai-entitlements-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Elaichi Entitlements API
version: 0.1.0
description: 'Control-plane HTTP API for Elaichi, the MCP control plane for SaaS teams. Authenticate with an organization API token (create one in the Elaichi app under Settings → API tokens) sent as a bearer token, plus the `X-Organization-Id` header on org-scoped routes; the MCP and OAuth endpoints use their own protocols. A few actions are deliberately not available to an API token and must be done by a person in the Elaichi app: managing API and SCIM tokens, creating an organization, approving an access request, deleting an organization, and changing the two-factor requirement. The operations concerned say so. Endpoints used only by the Elaichi app itself (sign-in, consent screens, browser redirects, inbound webhooks) are not documented.'
servers:
- url: https://api.elaichi.ai
description: Production
tags:
- name: Entitlements
paths:
/organization/{id}/entitlements:
get:
operationId: getOrganizationEntitlements
summary: Get effective plan and feature map
tags:
- Entitlements
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
plan:
type:
- string
- 'null'
enum:
- personal
- gold
- black
- null
description: Effective plan. `null` means on hold — gated routes answer 403 `subscription_required`.
trial_ends_at:
type:
- string
- 'null'
format: date-time
trial_active:
type: boolean
description: The local trial (Black for new organizations) before a subscription starts.
trial_indefinite:
type: boolean
description: 'Elaichi-granted indefinite trial: unlocked with no end date. `trial_active` stays false because there is no clock to count down.'
blocked:
type: boolean
description: Elaichi suspended this organization. `plan` reads `null` too, and subscribing does not lift it.
blocked_reason:
type:
- string
- 'null'
description: Why it was suspended, when `blocked`; else `null`.
features:
type: object
description: Feature key → allowed. A key that is absent is not offered to this organization — not an error. The response can carry further informational fields beyond those listed here.
additionalProperties:
type: boolean
features_granted:
type: boolean
description: Elaichi granted this organization features beyond its plan, with no change to billing. `features` already includes them.
feature_plans:
type: object
description: 'Feature key → the lowest plan that includes it. The same on every response: use it to name the plan that unlocks a feature `features` marks `false`.'
additionalProperties:
type: string
enum:
- personal
- gold
- black
plan_limits:
type: object
description: 'What each plan allows, from the catalog (identical on every response, like `feature_plans`): `{ members, connections, connectors, synthetic_tools, tool_calls }` per plan, or `null` for a plan with no limits.'
additionalProperties:
type:
- object
- 'null'
properties:
members:
type: integer
connections:
type: integer
connectors:
type: integer
synthetic_tools:
type: integer
tool_calls:
type: integer
description: Per calendar month (UTC).
access:
type: string
enum:
- full
- single_user_locked
description: 'Whether the CALLER may use the workspace. `single_user_locked`: the organization is on Personal, which admits only its primary owner (its creator, else its earliest active Org Owner), and the caller is not them; every other org route answers 403 `plan_single_user` until it upgrades. This route, the organization read and billing stay open.'
access_message:
type:
- string
- 'null'
description: The `plan_single_user` refusal's sentence, naming the owner, when `access` is `single_user_locked`; else `null`.
limits:
type:
- object
- 'null'
description: 'The plan''s limits, counted on the server; `null` on a plan without limits (only Personal has them), and `null` on Personal when the usage could not be counted. `reached` is the same comparison the refusing write makes: disable the add control on it. `used` can exceed `max` after a move to Personal; nothing is removed.'
properties:
members:
type: object
properties:
max:
type: integer
used:
type: integer
description: Exact, counted at read time.
reached:
type: boolean
description: '`used >= max`: the write that would add one more is refused.'
connections:
type: object
properties:
max:
type: integer
used:
type: integer
description: Exact, counted at read time.
reached:
type: boolean
description: '`used >= max`: the write that would add one more is refused.'
connectors:
type: object
properties:
max:
type: integer
used:
type: integer
description: Exact, counted at read time.
reached:
type: boolean
description: '`used >= max`: the write that would add one more is refused.'
synthetic_tools:
type: object
properties:
max:
type: integer
used:
type: integer
description: Exact, counted at read time.
reached:
type: boolean
description: '`used >= max`: the write that would add one more is refused.'
tool_calls:
type: object
properties:
max:
type: integer
used:
type: integer
description: Exact, counted at read time.
reached:
type: boolean
description: '`used >= max`: the write that would add one more is refused.'
resets_at:
type: string
format: date-time
description: Next 1st of the month, 00:00 UTC.
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Returns what this organization may use right now. Call this before offering a gated feature rather than reading `plan` off the organization: `plan` here is the effective plan (null while on hold), which folds in the trial and the Stripe subscription status. Any member may read it.'
security:
- bearerAuth: []
parameters:
- name: id
in: path
required: true
schema:
type: string
description: Organization id (`org_…`).
components:
schemas:
Error:
type: object
required:
- error
description: The Elaichi error envelope. The MCP OAuth endpoints under `/oauth` are the exception — they return RFC 6749 errors instead (see `OAuthError`).
properties:
error:
type: object
required:
- message
- code
properties:
message:
type: string
description: Human-readable. 5xx messages are deliberately generic.
code:
type: string
description: Stable machine-readable code, e.g. `not_found`, `subscription_required`.
details:
description: Structured detail for codes that carry one, e.g. `toolboxes_need_resolution`.
feature:
type: string
description: The gated feature, on entitlement failures.
plan:
type:
- string
- 'null'
enum:
- personal
- gold
- black
- null
additionalProperties: true
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: session or API token
description: '`Authorization: Bearer <token>` with an org-scoped API token (`elch_{org_id}_{64 hex}`), created in the Elaichi app under Settings → API tokens. The Elaichi app itself signs in with a session cookie, which is also accepted but is not meant for integrations. Two other credential families exist and are NOT interchangeable with this one: an MCP OAuth access token (`POST /mcp` only) and a SCIM token (`/scim/v2/*` only).'
mcpOAuth:
type: oauth2
description: MCP OAuth access token, used only by `POST /mcp` — not interchangeable with `bearerAuth`. Discovered per RFC 9728/8414 at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`.
flows:
authorizationCode:
authorizationUrl: https://api.elaichi.ai/oauth/authorize
tokenUrl: https://api.elaichi.ai/oauth/token
scopes:
mcp:read: Anything you can already see in Elaichi. Never secret values. It can also ask an admin for access to something restricted for you.
mcp:write: Create and change teams, roles, toolboxes, templates and connections, and share access.
mcp:destructive: Permanently delete data and remove access in Elaichi. This cannot be undone.
mcp:tools: Run tools from the toolboxes you choose next, deleting in your connected apps included. It can also ask an admin for access to something restricted for you.
openid: That you are signed in, and the user ID we use for you. Nothing else.
email: Your email address, and whether it is verified. Apps use this to check your domain.