List the organisation's entitlements

get/v1/entitlements

This endpoint is in the contract, but the API doesn't serve it during early access. It returns 404 for now.

Feature entitlements for the active org, with quantity limits and usage, so a client can show upsell before hitting a 402. The API enforces entitlements itself (e.g. POST /v1/dashboards). Small bounded set — not paginated.

curl "https://api.vojo-media.com/v1/entitlements" \
  -H "Authorization: Bearer $VOJO_KEY"

const { data, error } = await api.GET("/v1/entitlements");
if (error) throw new VojoApiError(error);

Response 200

{
  "data": [
    {
      "feature_key": "dashboards.author",
      "granted": true,
      "limit": 3,
      "used": 2
    }
  ],
  "meta": {}
}

Access

Authentication: Secret key or OAuth access token.
Scope: account:read
User permission: Membership of the organisation is enough.

Headers

Vojo-Organisationstring
The organisation this request acts on (org id). Required for oauth2 callers — a missing header returns 400 organisation_header_required; an org the user cannot access (a membership or an access grant, and granted to this OAuth client) returns 403 organisation_access_denied. Secret keys are bound to one org: the header may be omitted, and if sent it must match the key's org (else 403). Every query is scoped by the resolved org, never by an id in the body.
Vojo-Versionstring
Optional API version pin (a date). Overrides the version pinned on the secret key / organisation for this request. Echoed in the Vojo-Version response header. Within /v1 only additive changes ship, so most callers can omit it.
date

Response 200

dataarray of objectsRequired
Complete, unpaginated set.
Show 4 fields
- feature_keystringRequired
  Entitlement key, e.g. dashboards.author.
- grantedbooleanRequired
- limitinteger or nullRequired
  Quantity limit; null = unlimited or not quantity-based.
- usedinteger or nullRequired
  Current usage counted against limit; null when not tracked.
metaobjectRequired
Response metadata for single-resource responses. Reserved; currently empty. Clients must ignore unknown members.

Response headers

Vojo-Versionstring
The API version (date) this response was rendered with — the request's Vojo-Version, else the key/org pin.
RateLimitstring
IETF RateLimit header: remaining quota in the current window, e.g. "default";r=97;t=42.
RateLimit-Policystring
IETF RateLimit-Policy header, e.g. "default";q=100;w=60. Portal OAuth clients get a higher tier.

Errors

Every error is application/problem+json. Branch on its code.

400
Malformed request: invalid JSON, a bad cursor, a missing Vojo-Organisation for an OAuth caller, or an unknown Vojo-Version.
401
Missing, invalid, expired or revoked credential.
403
The caller is authenticated but not allowed: missing scope (insufficient_scope), missing Permissions flag (permission_denied), a client/installer persona on an operator endpoint (operator_access_required), or no access to the requested org (organisation_access_denied).
429
Rate limit exceeded for this principal. Back off for Retry-After seconds.
500
Unexpected server failure.