Read what the plan allows
What this organization’s PLAN allows — a different question from what the caller’s ROLE allows. Permission answers “is this person allowed”, entitlement answers “is this plan allowed”, and neither implies the other: an owner holds every permission there is and is still not entitled to a fourth staff seat on the free plan.
Any member may read it, behind no permission of its own — it is what a locked screen explains itself with, and hiding the reason a button is missing is worse than showing it.
Every feature in the catalogue is present, including the ones no plan carries, so a client can render an offer rather than an absence. limit is null whenever there is no number to send, and unlimited is what says which null it is: an allowance with no ceiling (true) against a ceiling of zero (false) — a feature this plan does not carry, or one that is not measured by a number at all. Do not read a bare null as an unlimited allowance; it is the same value on a feature nobody is entitled to.
No authentication method ever appears here. Password, magic link, one-time code, social and two-factor are free forever and are not in the catalogue at all. Resold SSO (SAML, SCIM) is the exception that makes the rule precise: it is a capability a tenant sells onward to their own enterprise customer, priced per connection, not a way somebody signs in.
This is a read gate and it fails open: when entitlements cannot be resolved the plan comes back as unknown with everything enabled, because an entitlements outage must not become a product outage. The API’s own gates remain the enforcement either way.
Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.
Response
The plan and its entitlements.
unknown means entitlements could not be resolved, and everything is enabled.
free, pro, unknown false when this is the fail-open default rather than a plan's answer — the same case plan: unknown names, said in a field a client can branch on. The body is still complete and still truthful: UserKit's own catalogue is compiled in, so every feature is here with every ceiling gone. What the field buys is a screen not presenting an outage as an upgrade.
Keyed by feature key.