A valid request URL is required to generate request examples{
"plan": "free",
"resolved": true,
"features": {
"staff_seats": {
"kind": "limit",
"enabled": true,
"limit": 3,
"unlimited": false
},
"analytics_retention": {
"kind": "limit",
"enabled": true,
"limit": 30,
"unlimited": false
},
"audit_log": {
"kind": "limit",
"enabled": true,
"limit": 30,
"unlimited": false
},
"billing_module": {
"kind": "boolean",
"enabled": false,
"limit": null,
"unlimited": false
},
"saml_connections": {
"kind": "per_unit",
"enabled": false,
"limit": null,
"unlimited": false
}
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Read what the plan allows
What this organization’s PLAN allows — a different question from what the caller’s ROLE allows. Permission answers “is this person allowed”, entitlement answers “is this plan allowed”, and neither implies the other: an owner holds every permission there is and is still not entitled to a fourth staff seat on the free plan.
Any member may read it, behind no permission of its own — it is what a locked screen explains itself with, and hiding the reason a button is missing is worse than showing it.
Every feature in the catalogue is present, including the ones no plan carries, so a client can render an offer rather than an absence. limit is null whenever there is no number to send, and unlimited is what says which null it is: an allowance with no ceiling (true) against a ceiling of zero (false) — a feature this plan does not carry, or one that is not measured by a number at all. Do not read a bare null as an unlimited allowance; it is the same value on a feature nobody is entitled to.
No authentication method ever appears here. The federated boot, the magic link and the one-time code are free forever and are not in the catalogue at all. Resold SSO (SAML, SCIM) is the exception that makes the rule precise: it is a capability a tenant sells onward to their own enterprise customer, priced per connection, not a way somebody signs in.
This is a read gate and it fails open: when entitlements cannot be resolved the plan comes back as unknown with everything enabled, because an entitlements outage must not become a product outage. The API’s own gates remain the enforcement either way.
A valid request URL is required to generate request examples{
"plan": "free",
"resolved": true,
"features": {
"staff_seats": {
"kind": "limit",
"enabled": true,
"limit": 3,
"unlimited": false
},
"analytics_retention": {
"kind": "limit",
"enabled": true,
"limit": 30,
"unlimited": false
},
"audit_log": {
"kind": "limit",
"enabled": true,
"limit": 30,
"unlimited": false
},
"billing_module": {
"kind": "boolean",
"enabled": false,
"limit": null,
"unlimited": false
},
"saml_connections": {
"kind": "per_unit",
"enabled": false,
"limit": null,
"unlimited": false
}
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Response
The plan and its entitlements.
unknown means entitlements could not be resolved, and everything is enabled.
free, pro, unknown false when this is the fail-open default rather than a plan's answer — the same case plan: unknown names, said in a field a client can branch on. The body is still complete and still truthful: UserKit's own catalogue is compiled in, so every feature is here with every ceiling gone. What the field buys is a screen not presenting an outage as an upgrade.
Keyed by feature key.
Show child attributes
Show child attributes