My Entitlements
Resolved feature flags for the calling account. Driven by the plan-entitlements system (migration 142+) — every feature on the platform is gated by a named entitlement key, and this endpoint returns the union of plan-level grants plus any per-account overrides.
Use this on app load to decide which UI affordances to show. The flat {feature_key, enabled} shape makes it cheap to Set<string> the enabled keys client-side and check membership with O(1). Calls from admin accounts always return every entitlement as enabled: true (matches the entitled() short-circuit in the server).
Accounts with no plan assigned (plan_id IS NULL) get an empty list — webapp should treat as "everything gated" and direct the user to billing.
Response (200 OK)
items array
List of
{feature_key, enabled} pairs. Each entitlement appears at most once.items[].feature_key string
Stable entitlement identifier. See the full key catalog below.
items[].enabled boolean
Whether the feature is currently enabled for the calling account.
Entitlement key catalog
The keys below are the stable identifiers checked by the dashboard and api-server. New keys are added by migration as features ship — treat unknown keys as enabled: false.
Domains & certificates
custom_subdomains
Reserve named subdomains under the platform apex (e.g.
myapp.ngris.com) instead of an ephemeral random one.custom_domains
Attach your own domains (e.g.
dev.example.com) with managed DNS + ACME issuance.custom_ssl
Upload and serve your own TLS certificate instead of platform-managed ACME.
dedicated_ips
Allocate dedicated edge IPv4 addresses for the account (quota-style;
limit_value controls count).dedicated_ports
Reserve fixed TCP/UDP ports on the regional ingress instead of the auto-assigned pool.
Traffic management
firewall_policies
WAF / firewall rule sets (per-endpoint policy attachment).
custom_rate_limits
Per-endpoint rate-limit rules above the plan-level default.
traffic_policies
Programmable traffic policies (header rewrites, redirects, mirroring, etc.).
endpoint_routing_rules
Server-side routing rules (path / header / agent-tag matching to direct traffic across multiple agents).
traffic_rule:redirect
Permission to create traffic rules of type
redirect.traffic_rule:webhook
Permission to create traffic rules of type
webhook.traffic_rule:jwt-validation
Permission to create traffic rules of type
jwt-validation.custom_error_pages
Serve account-defined error templates (quota-style;
limit_value caps the number of templates).Authentication & access
mtls_attachment
Attach mutual-TLS client-cert verification to endpoints.
sso
Account-level SSO (SAML / OIDC) for dashboard login.
rbac
Custom roles + fine-grained RBAC matrix for account members.
account_members
Allow non-owner members to access the account. The owner is always exempt; the per-account seat cap comes from
plans.max_members (0 / null = unlimited). On downgrade to a plan without this key, non-owner memberships are suspended.Observability
traffic_inspector
The per-request Traffic Inspector — list, detail, replay, export, and AI smart-search over traffic logs (
/traffic/logs*). Without it those endpoints return 403.security_analytics
Attacker-fingerprint + mitigation analytics over traffic logs (
/traffic/security-analytics). Returns 403 without it.replay_with_modification
Editable request replay in the traffic inspector. Without it, only verbatim replay is allowed.
metric_alerts
Threshold alerts (
/traffic/alerts) with email / webhook channels.endpoint_health
Endpoint health checks (synthetic probes against the public URL).
account_audit_log
Account-level activity / audit log (member changes, role grants, billing events).
Errors
401 Unauthorized
Missing or invalid auth.
500
Database error reading the entitlements table. Cache the previous response client-side as fallback.
Request
curl "https://api.ngris.com/v1/account/entitlements" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
ents = client.users.get_entitlements()
enabled = {e["feature_key"] for e in ents["items"] if e["enabled"]}
if "custom_ssl" in enabled:
print("Custom SSL is available on this plan")
Response — 200 OK
{
"items": [
{"feature_key": "custom_subdomains", "enabled": true},
{"feature_key": "custom_domains", "enabled": true},
{"feature_key": "custom_ssl", "enabled": true},
{"feature_key": "dedicated_ips", "enabled": false},
{"feature_key": "dedicated_ports", "enabled": false},
{"feature_key": "firewall_policies", "enabled": true},
{"feature_key": "custom_rate_limits", "enabled": true},
{"feature_key": "traffic_policies", "enabled": false},
{"feature_key": "endpoint_routing_rules", "enabled": false},
{"feature_key": "traffic_rule:redirect", "enabled": true},
{"feature_key": "traffic_rule:webhook", "enabled": false},
{"feature_key": "traffic_rule:jwt-validation", "enabled": false},
{"feature_key": "custom_error_pages", "enabled": true},
{"feature_key": "mtls_attachment", "enabled": true},
{"feature_key": "sso", "enabled": false},
{"feature_key": "rbac", "enabled": false},
{"feature_key": "account_members", "enabled": false},
{"feature_key": "traffic_inspector", "enabled": true},
{"feature_key": "security_analytics", "enabled": false},
{"feature_key": "replay_with_modification", "enabled": false},
{"feature_key": "metric_alerts", "enabled": true},
{"feature_key": "endpoint_health", "enabled": false},
{"feature_key": "account_audit_log", "enabled": false}
]
}