My Entitlements
Resolved feature flags for the calling account. Driven by the plan-entitlements system (migration 142+) — every feature on the platform is gated by a named entitlement key, and this endpoint returns the union of plan-level grants plus any per-account overrides.
Use this on app load to decide which UI affordances to show. The flat {feature_key, enabled} shape makes it cheap to Set<string> the enabled keys client-side and check membership with O(1). Calls from admin accounts always return every entitlement as enabled: true (matches the entitled() short-circuit in the server).
The list always carries every entitlement key. An account with no plan gets every key with enabled: false — treat that as "everything gated" and direct the user to billing.
Response (200 OK)
items array
List of
{feature_key, enabled} pairs. Each entitlement appears at most once.items[].feature_key string
Stable entitlement identifier. See the full key catalog below.
items[].enabled boolean
Whether the feature is currently enabled for the calling account.
items[].plan string
The slug of the plan the entitlement comes from (e.g.
team). Omitted on the admin all-enabled list.items[].limit_value int?
The feature's count for this account (a per-account override applied), for a feature that carries one, e.g.
custom_domains. -1 means unlimited. Omitted for an on/off feature. The same number is in plan_limits on /account/plan.grace array
Features the account keeps only until a downgrade grace period ends. Its plan no longer includes them. Each entry is
{feature_key, label, expires_at}, soonest first. Empty when nothing is ending. These features also appear in items as enabled: true until expires_at. See Downgrade grace. Not sent on the admin all-enabled list.quota_paused array
Resources paused because the account has more of them than its plan allows (for example after a downgrade): paused resources keep their data but are not served or applied until the account is back under the limit. One entry per feature that has paused resources:
{feature_key, label, paused, total, limit} — how many of the total are paused, and the plan's count (limit, omitted when the feature has no cap). [] when nothing is paused. Not sent on the admin all-enabled list.suspension object
Whether the account is suspended:
{suspended, kind, since} — kind is unpaid, usage, admin, abuse or other (omitted when not suspended). The same object as on /account, readable here by every member. Not sent on the admin all-enabled list.unpaid object?
null when nothing is owed; otherwise the date the account will be suspended (suspend_at) and, for a caller with billing access, which invoice is unpaid and how much is owed. The same object as on /account, where every field is described, except that it never carries the invoice's payment link (hosted_invoice_url): pay from Billing → Invoices in the dashboard. Not sent on the admin all-enabled list.Deprecated: until the sunset each item also carries the legacy integer plan_id. Don't use it; read plan.
Entitlement key catalog
The keys below are the stable identifiers checked by the dashboard and api-server. New keys are added by migration as features ship — treat unknown keys as enabled: false. A feature that carries a count (for example custom_domains, firewall_policies, sso) has its effective cap in plan_limits on /account/plan; the key names are listed on /plans.
Domains & certificates
custom_subdomains
Reserve named subdomains under the platform apex (e.g.
myapp.ngris.com) instead of an ephemeral random one.custom_domains
Attach your own domains (e.g.
dev.example.com) with managed DNS + ACME issuance.custom_ssl
Upload and serve your own TLS certificate instead of platform-managed ACME.
dedicated_ips
Allocate dedicated edge IPv4 addresses for the account (the count cap is
plan_limits.max_dedicated_ips).dedicated_ports
Reserve fixed TCP/UDP ports on the regional ingress instead of the auto-assigned pool.
Traffic management
firewall_policies
WAF / firewall rule sets (per-endpoint policy attachment).
custom_rate_limits
Per-endpoint rate-limit rules above the plan-level default.
traffic_policies
Programmable traffic policies (header rewrites, redirects, mirroring, etc.).
endpoint_routing_rules
Server-side routing rules (path / header / agent-tag matching to direct traffic across multiple agents).
traffic_rule:redirect
Permission to create traffic rules of type
redirect.traffic_rule:webhook
Permission to create traffic rules of type
webhook.traffic_rule:jwt-validation
Permission to create traffic rules of type
jwt-validation.custom_error_pages
Serve account-defined error templates (the template cap is
plan_limits.max_custom_error_pages).Authentication & access
mtls_attachment
Attach mutual-TLS client-cert verification to endpoints.
sso
Account-level SSO (OIDC, or Google / GitHub) for dashboard login.
rbac
Endpoint RBAC: endpoint access rules and per-endpoint role memberships.
account_rbac
Custom account roles (the per-resource permission matrix). The built-in Admin role works without it. Without it, custom roles can't be created, edited or assigned, and members who hold one have no permissions.
account_members
Allow non-owner members to access the account. The owner is always exempt; the per-account seat cap is
plan_limits.max_members on /account/plan (active members plus pending invitations, the owner included; -1 means unlimited). On downgrade to a plan without this key, non-owner memberships are suspended.Observability
traffic_inspector
The per-request Traffic Inspector — list, detail, replay, export, and AI smart-search over traffic logs (
/traffic/logs*). Without it those endpoints return 403.security_analytics
Attacker-fingerprint + mitigation analytics over traffic logs (
/traffic/security-analytics). Returns 403 without it.replay_with_modification
Editable request replay in the traffic inspector. Without it, only verbatim replay is allowed.
metric_alerts
Threshold alerts (
/traffic/alerts) with email / webhook channels.endpoint_health
Endpoint health checks (synthetic probes against the public URL).
account_audit_log
Account-level activity / audit log (member changes, role grants, billing events).
Errors
401 Unauthorized
Missing or invalid auth.
500
Database error reading the entitlements table. Cache the previous response client-side as fallback.
Request
curl "https://api.ngris.com/v1/account/entitlements" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
ents = client.users.get_entitlements()
enabled = {e["feature_key"] for e in ents["items"] if e["enabled"]}
if "custom_ssl" in enabled:
print("Custom SSL is available on this plan")
Response — 200 OK
{
"items": [
{"plan": "team", "feature_key": "custom_subdomains", "enabled": true},
{"plan": "team", "feature_key": "custom_domains", "enabled": true},
{"plan": "team", "feature_key": "custom_ssl", "enabled": true},
{"plan": "team", "feature_key": "dedicated_ips", "enabled": false},
{"plan": "team", "feature_key": "dedicated_ports", "enabled": false},
{"plan": "team", "feature_key": "firewall_policies", "enabled": true},
{"plan": "team", "feature_key": "custom_rate_limits", "enabled": true},
{"plan": "team", "feature_key": "traffic_policies", "enabled": false},
{"plan": "team", "feature_key": "endpoint_routing_rules", "enabled": false},
{"plan": "team", "feature_key": "traffic_rule:redirect", "enabled": true},
{"plan": "team", "feature_key": "traffic_rule:webhook", "enabled": false},
{"plan": "team", "feature_key": "traffic_rule:jwt-validation", "enabled": false},
{"plan": "team", "feature_key": "custom_error_pages", "enabled": true},
{"plan": "team", "feature_key": "mtls_attachment", "enabled": true},
{"plan": "team", "feature_key": "sso", "enabled": false},
{"plan": "team", "feature_key": "rbac", "enabled": false},
{"plan": "team", "feature_key": "account_members", "enabled": false},
{"plan": "team", "feature_key": "traffic_inspector", "enabled": true},
{"plan": "team", "feature_key": "security_analytics", "enabled": false},
{"plan": "team", "feature_key": "replay_with_modification", "enabled": false},
{"plan": "team", "feature_key": "metric_alerts", "enabled": true},
{"plan": "team", "feature_key": "endpoint_health", "enabled": false},
{"plan": "team", "feature_key": "account_audit_log", "enabled": false}
],
"grace": [
{"feature_key": "custom_domains", "label": "Custom Domains", "expires_at": "2026-10-01T09:30:00Z"}
],
"quota_paused": [],
"suspension": {"suspended": false, "since": null},
"unpaid": null
}
Was this helpful?