---
title: "Review before giving a plan: what team (or waiting address) each target would get it on, who is mailed, what it already has"
method: POST
path: "/operator/plan-grants/review"
tags: ["Operator"]
---

# Review before giving a plan: what team (or waiting address) each target would get it on, who is mailed, what it already has

`POST /operator/plan-grants/review`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/operator/plan-grants/review`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Request body

- object
  - `planId` 'pro' | 'business', required
  - `targets` object[], required
    - `type` 'organization' | 'user' | 'email', required
    - `value` string, required: an organization id, a user id, or an email address
  - `lang` string: the invitees' mail language (default English)

## Response `200`

Review

- object
  - `items` object[], required
    - `index` integer, required
    - `target` object, required
      - `type` 'organization' | 'user' | 'email', required
      - `value` string, required: an organization id, a user id, or an email address
    - `resolution` 'organization' | 'account' | 'pending' | 'not_found' | 'no_team' | 'disabled' | 'invalid', required: organization: that team; account: the user's own team; pending: no verified account yet — the grant waits for the sign-up; not_found, no_team (the person owns no team), disabled, invalid: nothing is given
    - `organizationId` string, uuid, nullable, required
    - `organizationName` string, nullable, required
    - `email` string, nullable, required
    - `recipients` string[], required: who the mail goes to: the invitee, or the team's owners
    - `existing` object[], required: grants this team (or address) already has that apply or wait
      - `id` string, uuid, required
      - `planId` 'pro' | 'business', required
      - `state` 'active' | 'pending' | 'unclaimed' | 'ended' | 'revoked', required: active: applies now; pending: waits for its address to sign up; unclaimed: nobody signed up in time; ended: its end passed; revoked: an operator took it back
      - `endsAt` string, nullable, required: ISO-8601 timestamp
      - `claimUntil` string, nullable, required: ISO-8601 timestamp
    - `duplicate` boolean, required: it already has an active or waiting grant of this plan: creating skips it (extend that one instead)
    - `unlimited` boolean, required: the team is on the platform-wide unlimited tier: a grant changes nothing for it
  - `mailAvailable` boolean, required

## Other responses

- `400`: Invalid request (code invalid_request)
- `403`: A session older than 5 minutes (details.reauthenticate) or without two-factor authentication (details.mfaRequired) (code forbidden)
- `404`: Not found, or no operator-console session (code not_found)
- `409`: Something changed since the review: review again (code conflict)
- `501`: Mail is not set up on this server: create with notify false (code not_configured)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)