---
title: "Get organization entitlements"
method: GET
path: "/org/entitlements"
tags: ["Organization"]
---

# Get organization entitlements

`GET /org/entitlements`

Get the authenticated organization's effective feature access and constraints after applying its plan, active trial treatment, plan status, and organization-specific overrides. Null constraint values mean unlimited.

## Response `200`

Effective organization entitlements

- OrgEntitlements — Effective feature access and constraints for the authenticated organization. Values already include trial treatment, plan status, and organization-specific overrides; consumers should use these resolved values instead of comparing plan IDs.
  - `features` OrgEntitlementFeatures, required
    - `browser_extensions` OrgBrowserExtensionEntitlement, required
      - `enabled` boolean, required — Whether browser extensions are available.
      - `max_stored_per_org` integer, nullable, required — Maximum active custom extensions the organization may store. Null means unlimited. Loading stored extensions into a browser is not plan-limited.
    - `browser_pools` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `browser_replays` OrgBrowserReplayEntitlement, required
      - `enabled` boolean, required — Whether browser replay recording is available.
      - `retention_days` integer, required — Number of days browser replays are retained, matching the replay reaper policy.
    - `credential_providers` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `credentials` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `custom_proxies` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `file_io` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `gpu` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `managed_auth` OrgManagedAuthEntitlement, required
      - `enabled` boolean, required — Whether managed auth is available.
      - `health_check_interval_default_seconds` integer, required — Effective interval in seconds used when a connection is created without an explicit health-check interval.
      - `health_check_interval_max_seconds` integer, required — Maximum accepted managed auth health-check interval in seconds.
      - `health_check_interval_min_seconds` integer, required — Minimum accepted managed auth health-check interval in seconds.
      - `max_connections` integer, nullable, required — Maximum active managed auth connections in the organization. Null means unlimited.
    - `managed_proxies` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `profiles` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
    - `proxy_bypass_hosts` OrgEntitlementFeature, required
      - `enabled` boolean, required — Whether the organization is entitled to use this feature.
  - `limits` OrgEntitlementLimits, required
    - `default_max_concurrent_invocations_per_app` integer, required — Effective org-level default concurrent invocation ceiling for apps without an app-specific override. App-specific overrides are not represented here.
    - `max_concurrent_browsers` integer, required — Effective organization-wide ceiling shared by on-demand browsers and browser pool reservations.
    - `max_concurrent_invocations` integer, required — Effective organization-wide concurrent app invocation ceiling.
  - `plan` OrgEntitlementPlan, required
    - `effective_id` 'FREE' | 'HOBBYIST' | 'START_UP' | 'ENTERPRISE', required — The plan used to resolve plan-based access. Active trials resolve to START_UP regardless of the contractual plan.
    - `id` 'FREE' | 'HOBBYIST' | 'START_UP' | 'ENTERPRISE', required — The organization's contractual plan identifier. Use the resolved feature and limit values, not this field, for access decisions.
    - `is_trialing` boolean, required — Whether the organization is currently within its trial period.
    - `status` 'NEEDS_PAYMENT_METHOD' | 'ACTIVE' | 'CANCELED' | 'UNPAID', nullable, required — Current billing status of the contractual plan, or null when no billing status is recorded. Status-sensitive feature values already account for it.
    - `trial_ends_at` string, date-time, nullable, required — Configured trial end timestamp, or null when the organization has no trial. A past timestamp may be returned when is_trialing is false.

## Other responses

- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

---

[API](https://skmtc.net/onkernel/apis/kernel-api.md) · [All operations](https://skmtc.net/onkernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onkernel/kernel-api/revisions/858365328f92/schema)