Sign in
internal

Proxy: day + month call counters for an org (Next.js dashboard)

Validates the end-user's Supabase token via auth.get_user (catches revocation; no new dep or secret). Derives the org server-side from the verified user id — never trusts a caller-supplied org_id (closes the IDOR). Still gated by X-Internal-Secret as defense-in-depth (only the Vercel proxy reaches this).

get/internal/account/usage

Headers

X-User-Tokenstring nullable
x-internal-secretstring nullable

Response

Successful Response

calls_todayinteger required
calls_this_monthinteger required
active_streamsinteger nullable
max_streamsinteger nullable

Changes

Changed in 1 of the 7 revisions of this API.13

  • b7c4b36e1fa113See the full diff
    • ●

      removed the optional property detail from the response with the 422 status

      response-optional-property-removed

    • ○

      added the required property details to the response with the 422 status

      response-required-property-added

    • ○

      added the required property error to the response with the 422 status

      response-required-property-added

    • ○

      added the required property message to the response with the 422 status

      response-required-property-added

    This revision also has 4 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog